CVE-2026-15571

The record

A flaw was found in the legacy client-initiated account-linking endpoint of Keycloak, a widely used open-source identity and access management solution. The mechanism used to protect the account-linking process from unauthorized requests relies on a hash that can be predicted by a malicious OIDC client. By tricking a user into authenticating, an attacker-controlled client can forge a valid linking URL to connect the victim's account to an attacker's external identity. This results in a full account takeover, allowing the attacker to log in as the victim.

Affected packages

Related vulnerabilities

• CVE-2026-87913 A missing S3 bucket ownership verification in the AWS Security Agent MCP server before… CWE-341
• CVE-2026-87912 A missing S3 bucket ownership verification in the AWS Security Agent plugin in Amazon… CWE-341
• CVE-2026-38968 ntopng through 6.6 is vulnerable to Predictable Session Identifier which can lead to… CWE-341
• CVE-2026-36609 Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 uses a static… CWE-341
• CVE-2026-42365 A guessable session cookie vulnerability exists in the Web Interface functionality of… CWE-341