CVE-2026-9087

Katalog CVE

CVSS 8.1 · High EPSS 0,39%

Kerentanan Authorization Bypass Through User-Controlled Key pada redhat build of keycloak. Skor CVSS 3.1 8.1 (High) menurut NVD.

Deskripsi (NVD)

A flaw was found in Keycloak. The cross-session verification proof is keyed only by (local userId, idpAlias) and is not bound to the upstream identity that was actually verified, so a second upstream account on the same IdP can consume it and get linked to the victim's local account.

Rincian

Terbit di NVD

20 Mei 2026

Terakhir diubah

23 Juli 2026

Status NVD

Modified

CVSS 3.1

8.1 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-639: Authorization Bypass Through User-Controlled Key

EPSS (30 hari)

0,39% peluang dieksploitasi; lebih tinggi dari 31,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://access.redhat.com/security/cve/CVE-2026-9087 advisory vendor
• https://bugzilla.redhat.com/show_bug.cgi?id=2480172 issue tracking · advisory vendor
• https://access.redhat.com/errata/RHSA-2026:25097
• https://access.redhat.com/errata/RHSA-2026:25098
• https://access.redhat.com/errata/RHSA-2026:30049
• https://access.redhat.com/errata/RHSA-2026:30050