A flaw was discovered in the AAP gateway that causes the auto‑link strategy to link external Identity Provider (IDP) identities to existing AAP user accounts solely on the basis of email matching, without verifying ownership. This allows a remote attacker to hijack a victim’s account or gain unauthorized access to other accounts, including administrative ones, by manipulating the email supplied by the IDP. The weakness corresponds to CWE‑305 and compromises confidentiality, integrity, and availability of user access control.

All affected systems are Red Hat Ansible Automation Platform 2.6 deployments on RHEL 9 and RHEL 10. The listed CPE identifiers correspond to the standard, developer, and inside variants of this platform, indicating that the vulnerability applies to all 2.6 releases on those operating systems.

The CVSS score of 8.3 indicates high severity, but the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a remote attacker controlling or spoofing the external IDP to supply a forged email address. Because the feature automatically trusts the email match, an attacker can hijack accounts without additional privileges, making the issue particularly dangerous for environments that rely on automated IDP integration.