CVE-2026-97175
CVE-2026-97175
A flaw was found in the idp-auto-link authenticator of the keycloak-services component, which handles user identity federation. The issue occurs when Keycloak automatically links an incoming identity from an external provider to an existing local account based on an email address without verifying if the provider has validated that email. This can allow an attacker to take over a victim's account by using a matching unverified email address at a brokered provider.
Vulnerability class: Broken Authentication
Published · last modified .
CVSS v3 metric
CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.
Weakness classification (CWE)
References
- RHSA-2026:95759 (vendor-advisory)
- RHSA-2026:95760 (vendor-advisory)
- RHSA-2026:95761 (vendor-advisory)
- RHSA-2026:95762 (vendor-advisory)
- access.redhat.com/security/cve/CVE-2026-97175 (vdb-entry)
Frequently asked questions
- What is CVE-2026-97175?
- CVE-2026-97175 is a high-severity vulnerability, classified under Improper Authentication. CVSS score: 8.8/10. Published 2026-11-05.
- How severe is CVE-2026-97175?
- High severity. CVSS v3 base score is 8.8 out of 10.