Keycloak Social Account Linking Authentication Bypass

Executive Summary

This vulnerability is in Keycloak's first-broker-login flow. When a user links a social identity provider account to their local account, the verification proof is not properly tied to that specific identity. An attacker with a different account on the same social provider can exploit this to link their account to the victim's local profile and gain unauthorized access.

Useful 0 Not Useful 0

Detection Guidance

Detecting this vulnerability requires monitoring Keycloak's first-broker-login flow for unusual account-linking activities. Check Keycloak logs for multiple social provider account associations to the same local account. Look for events where a user's local account is linked to a different social identity than expected. Review authentication logs for suspicious cross-session verification proofs that are not bound to a specific upstream identity.

Useful 0 Not Useful 0

Impact Analysis

If exploited, an attacker could gain unauthorized access to your local account by linking their social identity to it. This could allow them to access your data and permissions. Exploitation requires specific timing and user interaction during an active account-linking process.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to user data, which may violate GDPR's data protection requirements or HIPAA's access controls. Unauthorized account linking could expose personal or health information, potentially resulting in non-compliance with these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Keycloak to the latest version if available. If no upgrade is available, disable the first-broker-login flow or restrict social identity provider account linking to prevent unauthorized access.

Useful 0 Not Useful 0