A flaw in the idp-auto-link authenticator of Keycloak Services allows an attacker to link an unverified email address from an external identity provider to an existing local account without verification, enabling account takeover. This vulnerability is an authentication bypass (CWE‑287) that compromises account integrity by exploiting the automatic linking feature that trusts provider supplied email addresses.

The flaw affects Red Hat’s Build of Keycloak and Red Hat Single Sign‑On 7. No specific version numbers are listed, so all releases of these products are potentially impacted.

The CVSS score of 8.8 classifies this vulnerability as a high‑impact issue. The lack of an available vendor patch and the vendor's statement that no satisfactory workaround exists underscore the risk for attackers who can supply a matching unverified email address through a brokered provider. While the EPSS score is not available, the potential for remote authentication bypass and account takeover warrants close monitoring and remedial action when a patch becomes available. The vulnerability is not listed in CISA's KEV catalog.