CVE-2025-7365Keycloak First Broker Login TOCTOU, account-merge takeover
What broke
Keycloak First Broker Login checked an email (or linking condition) and then performed the account merge later. In the gap, an attacker could complete a broker login that attached their IdP identity to the victim. CWE-367. CVSS 3.1, because exploitation needs a user in the linking flow. Red Hat patched.
Why it matters
Account merge is how "I signed in with Google" becomes "I own the corporate user." A low CVSS does not mean a low identity impact. Anyone who enables First Broker Login or email-as-identity linking needs to read this next to Vault EntityID reuse.
What to do
- Upgrade Keycloak. Disable First Broker Login if you do not need social or partner linking.
- Do not auto-link on email match. Require a confirmed session on the existing account first.
- Review linked-identity tables for unexpected IdP aliases.
After you patch
Token-layer flaws produce credentials that keep working after the patch, so remediation is about invalidating what was issued.
- Rotate the signing keys published at your JWKS endpoint, then confirm relying parties refetch on an unknown key id rather than caching indefinitely.
- Revoke refresh tokens and sessions. Access tokens expire on their own; refresh tokens are the ones that turn a short compromise into months of access.
- Audit client registrations and consent grants created during the window, particularly any client with broad scopes or a redirect URI you do not recognize.
- Verify validation on your side: pinned algorithms, issuer and audience checks, and no acceptance of
alg: none. See JWT and the validate a JWT recipe.
Sources
- NVD: CVE-2025-7365
- Red Hat Keycloak advisory
Related identity CVEs
Related on Start with Identity
- CVEKeycloak accepts SAML from a disabled identity provider
A remote attacker can complete a broker login with a valid SAML response even after the SAML IdP is disabled in Keycloak. Unauthorized authentication via a cont
- CVEKeycloak Admin API auth bypass to custom attributes
Keycloak's Admin API let a caller read sensitive custom attributes they should not have seen (CWE-266). An authorization hole on the admin plane.
- CVEKeycloak authorization bypass
Keycloak failed an authorization check, so a caller could reach a resource their role should have blocked. Part of the April 2024 RHSA-2024:1868 set with CVE-20
- BlogA CVE ID is a name. The value is knowing who the attacker becomes.
We opened a practitioner catalog of identity CVEs: what broke, why IAM teams should care, and what to do this week. Not an NVD mirror. A place to triage SAML wr
- Comparisonfusionauth-vs-keycloak
FusionAuth and Keycloak are the two names that dominate the self-hosted identity conversation, but they sit on opposite sides of the open-source line. Keycloak
- BlogKeycloak password reset flaw let anyone skip the email token and take over any account
CVE-2026-18963 is improper state validation in Keycloak's reset-credentials flow. A crafted request jumped the authentication session straight to the password-u