Skip to content
TrackCVE
  • Newest CVEsPage
  • Recently added to KEVPage
  • Rising exploitation (EPSS)Page
  • Weekly digestPage
  • StatisticsPage
  • WatchlistPage
  • API documentationPage
  • MCP serverPage
  • Data sourcesPage
  • ChangelogPage
  • AboutPage
  • How it's builtPage
Back

CVE-2026-112208

Keycloak-services: keycloak-services: account takeover via stale sso_auth note in organization identity-first login

High8.1EPSS 0.45%
Published
Updated
Reserved
Assigned by
redhat

Description

A flaw was found in the Organization identity-first login flow of the Keycloak authentication server. Keycloak is an open-source identity and access management solution used to secure modern applications and services. The issue occurs when an attacker who belongs to multiple organizations initiates a login and then switches to a registration or password reset path. During this process, a flag indicating a successful login is not properly cleared when the user is removed from the session. An attacker can then provide a victim's username, and the system incorrectly treats the stale flag as proof of the victim's identity. This allows the attacker to bypass authentication and gain full access to the victim's account and connected applications.

Timeline

  1. ID reserved

    By redhat

  2. · 17 days later

    Published

  3. · 1 day later

    Record updated

Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.

Scores

CVSS scores of CVE-2026-112208, by who scored it
Scored byCVSSScoreVector
redhatCNA (assigner)3.1High8.1CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
NVDNVD · Awaiting Analysis3.1High8.1CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
EPSS (exploitation in 30 days)
0.45% · top 61% of all CVEs (7 Nov 2026)
Loading the EPSS history…

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 8.1.

Weakness

Affected products

What to do

Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. --- CME Mitigation Guidance (2026-11-06) --- Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure. The highest-value action is to ensure the SSO_AUTH re-authentication note is cleared from the authentication session whenever a flow transition strips the authenticated user: upgrade to Red Hat build of Keycloak 26.6.8 (or the fixed Rhbk/Keycloak Rhel/Keycloak Services builds), which clears the lingering SSO_AUTH re-authentication note from the authentication session during login flow transitions such as registration or credential reset, closing all 2 injection vectors (transition to credential reset flow, transition to registration flow). Until patched, this is a concern on Keycloak deployments with the Organization feature enabled and users holding credentials in multiple organizations, so Disable the Organization feature or ensure users cannot hold memberships across multiple organizations. These controls limit blast radius and contain exploitation, but they do not fix the underlying stale authentication state flag defect — apply the upstream patch to fully remediate.

References (4)

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

CVE-2026-112208 badge
[![CVE-2026-112208](https://trackcve.app/badge/CVE-2026-112208.svg)](https://trackcve.app/cve/CVE-2026-112208)

Record last updated .