The vulnerability in Keycloak allows a malicious actor to consume a cross‑session verification proof that is only keyed by a local userId and IdP alias, enabling the attacker to link a second upstream account from the same Identity Provider to the victim’s local account. This effectively permits account takeover or unauthorized account linkage. The weakness is an improper access control flaw identified as CWE-639, where the verification proof is not bound to the verified upstream identity.

Red Hat Build of Keycloak is affected. Specific product versions are not listed in the supplied data, so the exact scope of vulnerable releases cannot be determined from this report.

The flaw carries a CVSS score of 6.4, indicating a medium impact. The EPSS score is not available, and it is not listed in CISA’s KEV catalog, suggesting that widespread public exploitation has not been observed. The likely attack vector is an attacker controlling a second account on the same IdP who can replay the verification proof; the vulnerability can be exercised once the attacker has a valid cross‑session proof, which is typical during normal authentication flows. Given the lack of evidence of active exploitation, the risk is moderate but warrants timely remediation to prevent potential account hijacking.