CVE-2026-14781

A flaw exists in the org.keycloak.broker.oidc package where the OIDC broker incorrectly synchronizes the email_verified claim. When an OIDC identity provider is configured with trustEmail=true and the userinfo endpoint is enabled, Keycloak retrieves the email address from the userinfo response but retrieves the email_verified status exclusively from the id_token. The root cause is a lack of validation ensuring that the email_verified claim in the id_token actually refers to the email address returned by the userinfo endpoint. If these two sources return different email addresses, the id_token's email_verified=true claim is blindly applied to the userinfo email. Exploitation Conditions: The OIDC identity provider must have trustEmail set to true (non-default). The userinfo endpoint must be enabled (default). The attacker must control or have compromised the upstream OIDC provider. Concrete Impact: Mark arbitrary email addresses as verified in the Keycloak database. Bypass email-based security controls or verification workflows. Potential account takeover if the application relies solely on the email_verified flag from the IdP to link accounts.

• CWE-1288

• https://access.redhat.com/security/cve/CVE-2026-14781Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=2497118Issue Tracking, Vendor Advisory

Published

Jul 5, 2026

Last Modified

Aug 11, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-14774A vulnerability was determined in itsourcecode Hospital Mana…6.3
• CVE-2026-14775A vulnerability was identified in SourceCodester Onlne Exami…6.3
• CVE-2026-14776A security flaw has been discovered in SourceCodester Onlne …6.3
• CVE-2026-14777A weakness has been identified in SourceCodester Onlne Exami…6.3
• CVE-2026-14778A security vulnerability has been detected in SourceCodester…7.3
• CVE-2026-1478An out-of-band SQL injection vulnerability (OOB SQLi) has be…7.5
• CVE-2026-14782The Booking for Appointments and Events Calendar – Amelia pl…4.9
• CVE-2026-14783A vulnerability was determined in NousResearch hermes-agent …4.3
• CVE-2026-14784A vulnerability was identified in vxcontrol PentAGI up to 2.…6.3
• CVE-2026-14785The Web Directory Free plugin for WordPress is vulnerable to…7.5
• CVE-2026-14786A security flaw has been discovered in radareorg radare2 up …5.5
• CVE-2026-14787A weakness has been identified in radareorg radare2 up to 6.…7.8