CVE-2026-92358 Keycloak-services: keycloak-services: residual cross-browser account-link proof allows silent re-linking

A flaw was found in the first broker login flow of Keycloak. When a user confirms an account-linking request from a different browser, a temporary proof is created to validate the link. However, this proof is not properly cleared after the link is established or when the user later manually remov...

CVE-2026-92358

Keycloak 's first broker login flow contains a flaw where a temporary proof created during a cross-browser account-linking request is not properly cleared after the link is established or manually removed. An attacker who controls the external identity can exploit this residual proof to silently ...