Repository navigation
[CVE-2026-14781] OIDC broker applies id_token email_verified to userinfo email, marking unverified addresses as verified #50618
Description
CVE-2026-14781: A flaw exists in the org.keycloak.broker.oidc package where the OIDC broker incorrectly synchronizes the email_verified claim. When an OIDC identity provider is configured with trustEmail=true and the userinfo endpoint is enabled, Keycloak retrieves the email address from the userinfo response but retrieves the email_verified status exclusively from the id_token. The root cause is a lack of validation ensuring that the email_verified claim in the id_token actually refers to the email address returned by the userinfo endpoint. If these two sources return different email addresses, the id_token's email_verified=true claim is blindly applied to the userinfo email. Exploitation Conditions: The OIDC identity provider must have trustEmail set to true (non-default).
This issue was originally tracked in the private repository. Migrated by @ahus1.
Activity
Manage OIDC broker email verification (#50699)
Add idp alias to store federated tokens in user session notes (#50592)