Identity CVE · OAuth / OIDC / JWT
CVE-2025-7365Keycloak First Broker Login TOCTOU, account-merge takeover
low · CVSS 3.1
What broke
Keycloak First Broker Login checked an email (or linking condition) and then performed the account merge later. In the gap, an attacker could complete a broker login that attached their IdP identity to the victim. CWE-367. CVSS 3.1, because exploitation needs a user in the linking flow. Red Hat patched.
Why it matters
Account merge is how "I signed in with Google" becomes "I own the corporate user." A low CVSS does not mean a low identity impact. Anyone who enables First Broker Login or email-as-identity linking needs to read this next to Vault EntityID reuse.
What to do
- Upgrade Keycloak. Disable First Broker Login if you do not need social or partner linking.
- Do not auto-link on email match. Require a confirmed session on the existing account first.
- Review linked-identity tables for unexpected IdP aliases.
Sources
- NVD: CVE-2025-7365
- Red Hat Keycloak advisory
Related identity CVEs
Know a primary source we should add, or a patch status that has changed? Email [email protected]. See all briefs in the identity CVE catalog, or volunteer as a CVE Analyst.
Compiled from vendor advisories, NVD, CISA KEV, and public research. CVSS figures can disagree across NVD and the CNA. Confirm affected versions against the vendor advisory before you patch. Independent, community-driven analysis. See the disclaimer.