A flaw was found in Keycloak. When an authenticated attacker attempts to merge accounts with another existing account during an identity provider (IdP) login, the attacker will subsequently be prompted to "review profile" information. This vulnerability allows the attacker to modify their email address to match that of a victim's account, triggering a verification email sent to the victim's email address. The attacker's email address is not present in the verification email content, making it a potential phishing opportunity. If the victim clicks the verification link, the attacker can gain access to the victim's account.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - A flaw was found in Keycloak. When an authenticated attacker attempts to merge accounts with another
    existing account during an identity provider (IdP) login, the attacker will subsequently be prompted to
    "review profile" information. This vulnerability allows the attacker to modify their email address to
    match that of a victim's account, triggering a verification email sent to the victim's email address. The
    attacker's email address is not present in the verification email content, making it a potential phishing
    opportunity. If the victim clicks the verification link, the attacker can gain access to the victim's
    account. (CVE-2025-7365)

The version of Keycloak installed on the remote host is prior to 26.3.0. It is, therefore, affected by a phishing vulnerability. A flaw was found in Keycloak. When an authenticated attacker attempts to merge accounts with another existing account during an identity provider (IdP) login, the attacker will subsequently be prompted to 'review profile' information. This vulnerability allows the attacker to modify their email address to match that of a victim's account, triggering a verification email sent to the victim's email address. The attacker's email address is not present in the verification email content, making it a potential phishing opportunity. If the victim clicks the verification link, the attacker can gain access to the victim's account.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
460525	Echo: keycloak-25: security update to 25.0.6+e1org.keycloak:keycloak-services: security update to 26.0.13	Tenable Cloud Security	Echo Local Security Checks	Local	high
460525	Echo: keycloak-25: security update to 25.0.6+e1org.keycloak:keycloak-services: security update to 26.0.13	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	high
428684	SCA: security update for org.keycloak:keycloak-services (GHSA-xhpr-465j-7p9q)	Tenable Cloud Security	SCA Checks	Local	high
428684	SCA: security update for org.keycloak:keycloak-services (GHSA-xhpr-465j-7p9q)	Tenable Self-Hosted Container Security	SCA Checks	Local	high
242321	Keycloak < 26.3.0 Phishing Vulnerability	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2025-7365

high

Tenable Plugins

high

high

high

high

medium