Auth bypass in Red Hat Build Of Keycloak
CVE-2026-9087
A flaw was found in Keycloak. The cross-session verification proof is keyed only by (local userId, idpAlias) and is not bound to the upstream identity that was actually verified, so a second upstream account on the same IdP can consume it and get linked to the victim's local account.
Vulnerability class: IDOR (Insecure Direct Object Reference)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 6.4 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N.
EPSS exploit prediction
EPSS: 0.004 (30.7th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 31st percentile — 30.7% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.003 · newest: 0.004 · change: +0.001
Affected products
- Red Hat Build Of Keycloak
- Red Hat Build Of Keycloak 26.4 — versions 26.4.13-1, 26.4-19
- Red Hat Build Of Keycloak 26.4.13
- Red Hat Build Of Keycloak 26.6 — versions 26.6-8, 26.6-6, 26.6.3-3
- Red Hat Build Of Keycloak 26.6.3
- Red Hat Build Of Keycloak 26.6.4
- Red Hat Build Of Keycloak
Weakness classification (CWE)
References
- access.redhat.com/security/cve/CVE-2026-9087 (vdb-entry, Vendor Advisory)
- RHBZ#2480172 (issue-tracking, Issue Tracking, Vendor Advisory)
- RHSA-2026:25098 (vendor-advisory)
- RHSA-2026:25097 (vendor-advisory)
- RHSA-2026:30049 (vendor-advisory)
- RHSA-2026:30050 (vendor-advisory)
Frequently asked questions
- What is CVE-2026-9087?
- CVE-2026-9087 is a medium-severity vulnerability in Red Hat Build Of Keycloak, classified under Authorization Bypass Through User-Controlled Key. CVSS score: 6.4/10. Published 2026-05-20.
- How severe is CVE-2026-9087?
- Medium severity. CVSS v3 base score is 6.4 out of 10.