CVE-2026-97175 Keycloak-services: keycloak-services: unverified idp email auto-linking enables account takeover

A flaw was found in the idp-auto-link authenticator of the keycloak-services component, which handles user identity federation. The issue occurs when Keycloak automatically links an incoming identity from an external provider to an existing local account based on an email address without verifyin...

CVE-2026-97175

A vulnerability exists in the idp-auto-link authenticator of the keycloak-services component, which manages user identity federation. The root cause is that Keycloak automatically links incoming identities from external providers to existing local accounts based on matching email addresses withou...