The flaw resides in Keycloak's first-broker-login flow. When a user links a social identity provider (such as Google or Facebook) to their local Keycloak account, the generated verification proof is not tied to the specific upstream identity being verified. An attacker with another account on the same social provider can impersonate the victim by intercepting the verification process and linking their own account, thereby gaining unauthorized access. This vulnerability is an instance of CWE-639, where a lack of identity binding allows an attacker to link a different identity to a victim’s account.

All Red Hat Build of Keycloak deployments and Red Hat Single Sign-On 7 installations that enable social identity provider account linking are affected. The specific version range is not listed in the CVE record, so any current installation of these products should be considered vulnerable until a patch is released.

The CVSS score of 6.4 indicates medium severity. EPSS is not available, but the absence of a KEV listing and lack of a publicly documented exploit suggest that the risk is moderate. The likely attack vector involves an attacker who owns a different account on the same social identity provider; by using the first-broker-login flow, the attacker can inject their own verification proof and link the social account to the victim's local profile. The exploit requires only social provider credentials and does not need administrator privileges on the Keycloak server.