Cross-Session Flaw in Keycloak Affects Identity Management Solution
CVE-2026-9087
6.4MEDIUM
Key Information:
- Vendor
Red Hat
- Status
- Vendor
- CVE Published:
- 20 May 2026
What is CVE-2026-9087?
A security flaw exists in Keycloak where cross-session verification relies solely on local user identifiers, leading to potential misuse by attackers. When verified upstream accounts are not securely associated with the user's local identity, multiple accounts on the same Identity Provider (IdP) can exploit this vulnerability. This means that an attacker with another account on the same IdP might gain unauthorized access to the victim's local account, potentially compromising sensitive information and user privacy.
Affected Version(s)
Red Hat build of Keycloak 26.4 26.4.13-1
Red Hat build of Keycloak 26.4 26.4-19
Red Hat build of Keycloak 26.4 26.4-19