Log in Start free

Vulnerability · Published Nov 5, 2026 · Assigned by redhat

CVE-2026-112208Keycloak-services: keycloak-services: account takeover via stale sso_auth note in organization identity-first login

High 8.1

In plain English

A high-severity security flaw in Red Hat Build of Keycloak from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 33% of all known vulnerabilities).

Severity (CVSS 3.1)8.1High
Exploit odds (30 days)0.4%top 67.1% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

A flaw was found in the Organization identity-first login flow of the Keycloak authentication server. Keycloak is an open-source identity and access management solution used to secure modern applications and services. The issue occurs when an attacker who belongs to multiple organizations initiates a login and then switches to a registration or password reset path. During this process, a flag indicating a successful login is not properly cleared when the user is removed from the session. An attacker can then provide a victim's username, and the system incorrectly treats the stale flag as proof of the victim's identity. This allows the attacker to bypass authentication and gain full access to the victim's account and connected applications.

Affected products (as reported)

VendorProductVersions
Red Hat Red Hat Build of Keycloak see references
Red Hat Red Hat Build of Keycloak see references
Red Hat Red Hat Single Sign-On 7 see references

Weakness: CWE-305 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

References