VDB
CVE-2026-15571
CVE-2026-15571
PUBLISHED
CVSS 7.3 HIGH
Reported by redhat · Published August 18, 2026
A flaw was found in the legacy client-initiated account-linking endpoint of Keycloak, a widely used open-source identity and access management solution. The mechanism used to protect the account-linking process from unauthorized requests relies on a hash that can be predicted by a malicious OIDC client. By tricking a user into authenticating, an attacker-controlled client can forge a valid linking URL to connect the victim's account to an attacker's external identity. This results in a full account takeover, allowing the attacker to log in as the victim.
Risk Scores
CVSS 3.1
7.3
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | Red Hat build of Keycloak 26.6 | 26.6.6-1 |
| Red Hat | Red Hat build of Keycloak 26.6 | 26.6-12 |
| Red Hat | Red Hat build of Keycloak 26.6 | 26.6-12 |
| Red Hat | Red Hat build of Keycloak 26.6.6 | |
| Red Hat | Red Hat build of Keycloak 26.6.6 | |
| Red Hat | Red Hat build of Keycloak 26.6.6 | |
| Red Hat | Red Hat Data Grid 8 | |
| Red Hat | Red Hat JBoss Enterprise Application Platform Expansion Pack | |
| Red Hat | Red Hat Single Sign-On 7 | |
| Red Hat | Red Hat build of Keycloak 26.6.6 | |
| Red Hat | Red Hat build of Keycloak 26.6 | 26.6-12, 26.6-12 |
| Red Hat | Red Hat build of Keycloak 26.6 | 26.6.6-1, 26.6.6-1 |
| Red Hat | Red Hat JBoss Enterprise Application Platform Expansion Pack | |
| Red Hat | Red Hat Data Grid 8 | |
| Red Hat | Red Hat build of Keycloak 26.6 | 26.6-12, 26.6-12 |
| Red Hat | Red Hat build of Keycloak 26.6.6 | |
| Red Hat | Red Hat build of Keycloak 26.6 | 26.6.6-1 |
| Red Hat | Red Hat build of Keycloak 26.6 | 26.6-12 |
| Red Hat | Red Hat build of Keycloak 26.6.6 | |
| Red Hat | Red Hat Single Sign-On 7 |
…and 1 more
Timeline
- Aug 18, 2026 CVE Published
- Aug 19, 2026 Distribution Patch
- Aug 19, 2026 Security Advisory
- Aug 19, 2026 Distribution Patch
- Aug 19, 2026 Security Advisory
- Aug 22, 2026 Coalition ESS Score
- Aug 24, 2026 EPSS Score
- Aug 27, 2026 EPSS Score
- Sep 1, 2026 EPSS Score
References
- RHSA-2026:56523 vendor-advisoryx_refsource_REDHAT
- RHSA-2026:56524 vendor-advisoryx_refsource_REDHAT
- vdb-entryx_refsource_REDHAT
- RHBZ#2499591 issue-trackingx_refsource_REDHAT