A flaw was found in Keycloak. The cross-session verification proof is keyed only by (local userId, idpAlias) and is not bound to the upstream identity that was actually verified, so a second upstream account on the same IdP can consume it and get linked to the victim's local account.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - A flaw was found in Keycloak. The cross-session verification proof is keyed only by (local userId,
    idpAlias) and is not bound to the upstream identity that was actually verified, so a second upstream
    account on the same IdP can consume it and get linked to the victim's local account. (CVE-2026-9087)

ID	Name	Product	Family	Type	Severity
459860	Echo: org.keycloak:keycloak-services: security update to 26.6.3	Tenable Cloud Security	Echo Local Security Checks	Local	high
459860	Echo: org.keycloak:keycloak-services: security update to 26.6.3	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	high
443087	SCA: security update for org.keycloak:keycloak-services (GHSA-m6qj-3mpp-57v8)	Tenable Cloud Security	SCA Checks	Local	high
443087	SCA: security update for org.keycloak:keycloak-services (GHSA-m6qj-3mpp-57v8)	Tenable Self-Hosted Container Security	SCA Checks	Local	high

Detections

Analytics

CVE-2026-9087

high

Tenable Plugins

high

high

high

high