Most recent entries from all https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 23:14:07 +0000 CVE-2026-9087 — Keycloak: cross-session email verification proof not bound to upstream identity in first-broker-login https://cve.radiocsirt.org/vuln/cve-2026-9087 <p><strong>Affected:</strong> Red Hat build of Keycloak 26.4, Red Hat build of Keycloak 26.4.13, Red Hat build of Keycloak 26.6, Red Hat build of Keycloak 26.6.3</p> <p>A flaw was found in Keycloak. The cross-session verification proof is keyed only by (local userId, idpAlias) and is not bound to the upstream identity that was actually verified, so a second upstream account on the same IdP can consume it and get linked to the victim&#39;s local account.</p> <p><strong>Affected:</strong> Red Hat build of Keycloak 26.4, Red Hat build of Keycloak 26.4.13, Red Hat build of Keycloak 26.6, Red Hat build of Keycloak 26.6.3</p> <p>A flaw was found in Keycloak. The cross-session verification proof is keyed only by (local userId, idpAlias) and is not bound to the upstream identity that was actually verified, so a second upstream account on the same IdP can consume it and get linked to the victim&#39;s local account.</p> https://cve.radiocsirt.org/vuln/cve-2026-9087