Description
A flaw exists in the org.keycloak.broker.oidc package where the OIDC broker incorrectly synchronizes the email_verified claim. When an OIDC identity provider is configured with trustEmail=true and the userinfo endpoint is enabled, Keycloak retrieves the email address from the userinfo response but retrieves the email_verified status exclusively from the id_token.
The root cause is a lack of validation ensuring that the email_verified claim in the id_token actually refers to the email address returned by the userinfo endpoint. If these two sources return different email addresses, the id_token's email_verified=true claim is blindly applied to the userinfo email.
Exploitation Conditions:
The OIDC identity provider must have trustEmail set to true (non-default).

The userinfo endpoint must be enabled (default).

The attacker must control or have compromised the upstream OIDC provider.


Concrete Impact:
Mark arbitrary email addresses as verified in the Keycloak database.

Bypass email-based security controls or verification workflows.

Potential account takeover if the application relies solely on the email_verified flag from the IdP to link accounts.
Published: 2026-07-05
Score: 4.8 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

Keycloak’s OIDC broker incorrectly uses the email_verified claim from the id_token for the email address returned by the userinfo endpoint, a flaw linked to CWE‑1288 due to improper validation. If an attacker controls the upstream IdP and trustEmail is enabled, the IdP can issue an id_token marking a forged email as verified while delivering a different email through the userinfo response. Keycloak stores this mismatched address as verified, enabling email verification forgery and possible account takeover when applications rely on the email_verified flag.

Affected Systems

The vulnerability affects several Red Hat distributions that include a build of Keycloak, Red Hat Data Grid 8, Red Hat JBoss Enterprise Application Platform Expansion Pack, and Red Hat Single Sign‑On 7. All installations that use the org.keycloak.broker.oidc package are potentially vulnerable if they expose the userinfo endpoint and have trustEmail enabled. Specific affected version information is not available from the CNA data.

Risk and Exploitability

The CVSS score of 4.8 indicates a moderate impact on confidentiality and integrity. The EPSS score of less than 1% and the absence of a KEV listing are provided by the data. The attack clearly requires control of an upstream OIDC provider with trustEmail set to true, as stated explicitly. Based on the description, it is inferred that overall exploitation risk remains relatively contained.

Generated by OpenCVE AI on July 23, 2026 at 15:57 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the latest Red Hat security update that fixes CVE‑2026‑14781.
  • Disable the trustEmail setting in the OIDC configuration or restrict it to fully trusted providers only.
  • Configure Keycloak to validate that the email_verified claim in the id_token matches the email returned by the userinfo endpoint, rejecting any mismatches.

Generated by OpenCVE AI on July 23, 2026 at 15:57 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 06 Jul 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Sun, 05 Jul 2026 12:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Moderate

Sun, 05 Jul 2026 07:00:00 +0000

Type Values Removed Values Added
Description A flaw exists in the org.keycloak.broker.oidc package where the OIDC broker incorrectly synchronizes the email_verified claim. When an OIDC identity provider is configured with trustEmail=true and the userinfo endpoint is enabled, Keycloak retrieves the email address from the userinfo response but retrieves the email_verified status exclusively from the id_token. The root cause is a lack of validation ensuring that the email_verified claim in the id_token actually refers to the email address returned by the userinfo endpoint. If these two sources return different email addresses, the id_token's email_verified=true claim is blindly applied to the userinfo email. Exploitation Conditions: The OIDC identity provider must have trustEmail set to true (non-default). The userinfo endpoint must be enabled (default). The attacker must control or have compromised the upstream OIDC provider. Concrete Impact: Mark arbitrary email addresses as verified in the Keycloak database. Bypass email-based security controls or verification workflows. Potential account takeover if the application relies solely on the email_verified flag from the IdP to link accounts.
Title Keycloak-services: keycloak-services: oidc email_verified claim incorrectly applied to userinfo email
First Time appeared Redhat
Redhat build Keycloak
Redhat jboss Data Grid
Redhat jbosseapxp
Redhat red Hat Single Sign On
Weaknesses CWE-1288
CPEs cpe:/a:redhat:build_keycloak:
cpe:/a:redhat:jboss_data_grid:8
cpe:/a:redhat:jbosseapxp
cpe:/a:redhat:red_hat_single_sign_on:7
Vendors & Products Redhat
Redhat build Keycloak
Redhat jboss Data Grid
Redhat jbosseapxp
Redhat red Hat Single Sign On
References
Metrics cvssV3_1

{'score': 4.8, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N'}

Subscriptions

Redhat Build Keycloak Jboss Data Grid Jbosseapxp Red Hat Single Sign On
cve-icon MITRE

Status: PUBLISHED

Assigner: redhat

Published:

Updated: 2026-07-06T14:12:11.151Z

Reserved: 2026-07-05T06:32:45.726Z

Link: CVE-2026-14781

cve-icon Vulnrichment

Updated: 2026-07-06T14:11:58.963Z

cve-icon NVD

No data.

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-07-05T06:49:14Z

Links: CVE-2026-14781 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-07-23T16:00:14Z

Weaknesses
  • CWE-1288

    Improper Validation of Consistency within Input