Account Merge Vulnerability in Keycloak by Red Hat

CVE-2025-7365

What is CVE-2025-7365?

A security flaw in Keycloak enables authenticated attackers to exploit the account merging feature during identity provider logins. By attempting to merge their account with that of another user, attackers can alter their profile information, specifically changing their email address to match the victim's. This modification triggers a verification email sent to the victim without disclosing the attacker's email. If the victim interacts with the verification link, the attacker can gain unauthorized access to their account, presenting significant security risks including potential phishing attempts.

References