An attacker can predict the hash used by Keycloak’s legacy client‑initiated account‑linking endpoint, allowing a malicious OIDC client to forge a linking URL. By tricking a user into authenticating, the attacker’s client can link the victim’s account to the attacker’s external identity, resulting in full account takeover and the ability to log in as the victim.

Red Hat build of Keycloak 26.6 and 26.6.6, Red Hat Single Sign‑On 7, Red Hat Data Grid 8, and Red Hat JBoss Enterprise Application Platform Expansion Pack are affected. These systems run the legacy account‑linking service that relies on the predictable hash.

The CVSS score of 7.3 indicates a medium‑to‑high severity. With no EPSS score available and the vulnerability not listed in the CISA KEV catalog, the exploitation likelihood appears moderate and not actively targeted. The attack requires a malicious OIDC client in control and the ability to trick a user into authenticating; once the attacker has a valid linking URL, full credential takeover follows.