VDB

CVE-2026-15571

CVE-2026-15571 PUBLISHED CVSS 7.3 HIGH

Reported by redhat · Published August 18, 2026

A flaw was found in the legacy client-initiated account-linking endpoint of Keycloak, a widely used open-source identity and access management solution. The mechanism used to protect the account-linking process from unauthorized requests relies on a hash that can be predicted by a malicious OIDC client. By tricking a user into authenticating, an attacker-controlled client can forge a valid linking URL to connect the victim's account to an attacker's external identity. This results in a full account takeover, allowing the attacker to log in as the victim.

Risk Scores

CVSS 3.1
7.3
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

Affected Products

VendorProductVersions
Red HatRed Hat build of Keycloak 26.626.6.6-1
Red HatRed Hat build of Keycloak 26.626.6-12
Red HatRed Hat build of Keycloak 26.626.6-12
Red HatRed Hat build of Keycloak 26.6.6
Red HatRed Hat build of Keycloak 26.6.6
Red HatRed Hat build of Keycloak 26.6.6
Red HatRed Hat Data Grid 8
Red HatRed Hat JBoss Enterprise Application Platform Expansion Pack
Red HatRed Hat Single Sign-On 7
Red HatRed Hat build of Keycloak 26.6.6
Red HatRed Hat build of Keycloak 26.626.6-12, 26.6-12
Red HatRed Hat build of Keycloak 26.626.6.6-1, 26.6.6-1
Red HatRed Hat JBoss Enterprise Application Platform Expansion Pack
Red HatRed Hat Data Grid 8
Red HatRed Hat build of Keycloak 26.626.6-12, 26.6-12
Red HatRed Hat build of Keycloak 26.6.6
Red HatRed Hat build of Keycloak 26.626.6.6-1
Red HatRed Hat build of Keycloak 26.626.6-12
Red HatRed Hat build of Keycloak 26.6.6
Red HatRed Hat Single Sign-On 7

…and 1 more

Timeline

  • Aug 18, 2026 CVE Published
  • Aug 19, 2026 Distribution Patch
  • Aug 19, 2026 Security Advisory
  • Aug 19, 2026 Distribution Patch
  • Aug 19, 2026 Security Advisory
  • Aug 22, 2026 Coalition ESS Score
  • Aug 24, 2026 EPSS Score
  • Aug 27, 2026 EPSS Score
  • Sep 1, 2026 EPSS Score

References

Open in Interactive Console →
$ Console Community · 100/wk Open console ›