CVE-2026-9087: Red Hat Build Of Keycloak

High severity, CVSS 8.1. EPSS: 0.4% chance of exploitation in the next 30 days.

A flaw was found in Keycloak. The cross-session verification proof is keyed only by (local userId, idpAlias) and is not bound to the upstream identity that was actually verified, so a second upstream account on the same IdP can consume it and get linked to the victim's local account.

Affected products

• Red Hat Build Of Keycloak: affected versions not specified

Published 2026-05-20. Last modified 2026-07-23.