Repository navigation
[CVE-2026-97175] Block auto-linking when IdP email is unverified - #54900
Conversation
There was a problem hiding this comment.
🟡 Changes recommended
The email-trust guard still permits unverified-email account linking through username collisions and rejects legitimate links after email ownership confirmation.
2 open issues
What changed in this PR
This PR hardens identity-provider auto-linking against unverified-email account takeover, addressing #54707.
Changes:
- Adds email trust and verification checks and blocks auto-linking after email or username edits during profile review.
- Expands broker-login regression coverage for trusted, unverified, edited, and mapped identities.
- Documents the behavior change and upgrade considerations.
| File | Description |
|---|---|
| tests/base/src/test/java/org/keycloak/tests/broker/KcOidcFirstBrokerLoginDetectExistingUserTest.java | Marks the successful auto-link test’s provider email as verified. |
| tests/base/src/test/java/org/keycloak/tests/broker/IdpCreateUserIfUniqueAuthenticatorTest.java | Adds auto-link security, success, and fallback scenarios. |
| services/src/main/java/org/keycloak/authentication/authenticators/broker/IdpAutoLinkAuthenticator.java | Adds profile-edit and email-trust guards before linking. |
| server-spi-private/src/main/java/org/keycloak/broker/provider/BrokeredIdentityContext.java | Exposes the broker email’s verification status. |
| docs/documentation/upgrading/topics/changes/changes-27_0_0.adoc | Documents auto-link restrictions and Trust Email upgrade guidance. |
Review effort: Balanced
There was a problem hiding this comment.
🟡 Changes recommended
An attacker-controlled mapped email can retain the original email_verified flag and bypass the auto-link guard even with Trust Email disabled, enabling account takeover.
1 open issue
2 resolved since last review
Review effort: Balanced
|
@msdaly200 The changes introduced here (ead08a2) broke existing behaviour. Before 26.6.8, when the external IDP does not set This change here (#54268) would only check the ID token for Was this breaking change intended? It breaks for example with Entra ID because they never send |
|
Thanks @sschu for pointing this out. This was not intentional. The issue is addressed in #54268, which is currently waiting for approval. Once #54268 is backported, providers like Entra ID that omit email_verified will correctly retain the previous behavior and set email_verified=true when Trust Email is enabled. There is also a test - testTrustEmailWhenEmailVerifiedClaimIsMissingFromUserInfo for this. |
|
@msdaly200 From my understanding of #54268 , it would not fix this issue. It just adds a lookup into the ID Token when the claim is missing in the Userinfo endpoint. The behavior is the same when email_verified is missing in UserInfo and ID Token. Or am I missing something? |
|
@sschu You're right that #54268 specifically adds the ID token fallback logic, so had to dig a bit, but it was branched after #53580 (commit 34bcada - "Regression with Trust Email when the userinfo endpoint is used"), which fixed the Boolean.parseBoolean parsing bug from ead08a2. That regression fix (#53580) was backported to 26.8 (#53594), but was never backported to 26.6. Because #54268 includes both #53580 and the ID token fallback, backporting #54268 to 26.6 (or cherry-picking #53580) should restore the expected behavior for Entra ID where email_verified is omitted. |
|
@msdaly200 Thanks, sounds good! |
Closes keycloak#54707 Signed-off-by: Marie Daly <marie.daly1@ibm.com>
There was a problem hiding this comment.
🟡 Changes recommended
The confirmation-flow reset clears edited-email provenance, allowing an attacker to auto-link a victim’s account without ownership confirmation after returning to profile review.
1 open issue
1 resolved since last review
Review effort: Balanced
| String emailChanged = context.getAuthenticationSession().getAuthNote(AbstractIdentityProvider.UPDATE_PROFILE_EMAIL_CHANGED); | ||
| boolean emailWasEdited = "true".equals(emailChanged); |
There was a problem hiding this comment.
Thanks @msdaly200! Same changes than in branches!
Closes #54707
Unverified IdP emails could be used to auto-link a brokered identity to an existing consumer account, enabling account takeover without any user interaction.
IdpAutoLinkAuthenticator did not check whether the email provided by the IdP was actually verified before using it to link an existing user account. Change is also documented.