A flaw in the organization identity‑first login flow causes a flag that indicates a successful login to remain set when a user is removed from the session. This stale flag can be used by an attacker who is a member of multiple organizations to impersonate another user. By providing the victim's username the system mistakenly treats the stale flag as proof of identity, allowing the attacker to bypass authentication and gain full access to the victim account and any applications that rely on the same identity provider.

The vulnerability affects Red Hat Build of Keycloak and Red Hat Single Sign‑On 7. No specific patched versions are listed in the CNA data, so the scope remains broad for all versions of these products that include the organization identity‑first login flow.

The CVSS score of 8.1 rates this as a high‑severity vulnerability. The EPSS score is not available, indicating no publicly reported exploitation at the time of analysis; however, the vulnerability is listed in the KEV catalog as not listed. The likely attack vector involves an attacker being authenticated to multiple organizations and manipulating the login flow to trigger the stale flag. The flaw requires no privileged system access and can be exploited from the application layer, making it potentially reachable by actors who can simulate legitimate login attempts.