CVE Tools
Sign in

CVE-2026-15571

Keycloak-services: keycloak-services: predictable account-linking hash enables account takeover via malicious oidc client

Published: Aug 18, 2026Updated: Aug 20, 2026 Sources: CVE List NVDCWE-341
7.3HIGH
NVD MITRE
EPSS Score
0.3%
Top 74.8%
CISA KEV
Not in KEV
Exploits
No Known Exploits
Remediation
No Fix Available
Self-Check
OpenVAS

Description

A flaw was found in the legacy client-initiated account-linking endpoint of Keycloak, a widely used open-source identity and access management solution. The mechanism used to protect the account-linking process from unauthorized requests relies on a hash that can be predicted by a malicious OIDC client. By tricking a user into authenticating, an attacker-controlled client can forge a valid linking URL to connect the victim's account to an attacker's external identity. This results in a full account takeover, allowing the attacker to log in as the victim.

No summary for this CVE yet.

CVSS Vector Breakdown

AV:NAC:LPR:LUI:RS:UC:HI:HA:N
Exploitability
AV:NAttack Vector
Network
AC:LAttack Complexity
Low
PR:LPrivileges Required
Low
UI:RUser Interaction
Required
Scope
S:UScope
Unchanged
Impact
C:HConfidentiality
High
I:HIntegrity
High
A:NAvailability
None
Open in CVSS calculator →

Weaknesses

CWE-341

Affected Products

Red Hat
commercial·US
Red Hat build of Keycloak 26.6On-prem
Security Products / identity-access-mgmt
Red Hat build of Keycloak 26.6.6On-prem
Operating Systems / linux-distro
Red Hat Data Grid 8On-premDatabase
Databases / cache-message-queue
Red Hat JBoss Enterprise Application Platform Expansion PackOn-premOS
Operating Systems / linux-distro
Red Hat Single Sign-On 7On-premSecurity Product
Security Products / identity-access-mgmt

Exploitability

No known exploits, KEV entries, or remediation guidance available for this vulnerability yet.
Is your org exposed to CVE-2026-15571?We can run the check for you — a free external exposure review, no install. Check my exposure

References

https://access.redhat.com/errata/RHSA-2026:56523
access.redhat.com
https://access.redhat.com/errata/RHSA-2026:56524
access.redhat.com
https://access.redhat.com/security/cve/CVE-2026-15571
access.redhat.com
and 1 more references View all →
News mentions
1

Unlock Complete Vulnerability Intelligence

Get the full picture for CVE-2026-15571 and every CVE in our database. Create a free account — no credit card required.

Create Free Account
Plain-language analysis
Impact assessment and exploitation scenario in plain English
Attack graph visualization
Interactive attack path and kill chain mapping
Exploit details & PoC links
ExploitDB, Metasploit, GitHub PoCs with direct links
Nuclei scanner templates
Ready-to-use vulnerability scanner templates
Full remediation guide
Patch instructions, workarounds, and compliance impact
Interactive AI chat
Ask questions about this vulnerability in natural language
Related vulnerabilities
Semantically similar CVEs and attack patterns
REST API & MCP access
Integrate vulnerability data into your workflows