# CVE-2026-97175

Keycloak auto-link flaw enables account takeover via unverified brokered emails.

- Page: https://www.vulneraibility.com/cve/CVE-2026-97175
- CVSS: 8.8
- Known exploited: not in CISA KEV as of our last sync
- Weakness: CWE-287
- Published: 2026-11-05

## Affected

- Keycloak
- keycloak-services
- idp-auto-link authenticator

## Impact

Remote account takeover by auto-linking unverified external identities to existing local accounts, granting attacker access to victim's resources.

## Action

Immediate action required

## Recommendation

Disable idp-auto-link or require verified emails; apply vendor patch ASAP.

## References

- [other] https://access.redhat.com/security/cve/CVE-2026-97175

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.