| Package | Affected versions | Patched versions |
|---|---|---|
| org.keycloak:keycloak-services | < 26.6.3 | 26.6.3 |
A flaw was found in Keycloak. The cross-session verification proof is keyed only by (local userId, idpAlias) and is not bound to the upstream identity that was actually verified, so a second upstream account on the same IdP can consume it and get linked to the victim's local account.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free