{"id":"EM-20261105-I3CC","url":"https://cyber.eventmonitor.net/incident/EM-20261105-I3CC/vulnerability-cve-2026-97175/","type":"cve","title":"Vulnerability (CVE-2026-97175)","subtitle":"CVE-2026-97175","subject":"CVE-2026-97175","status":"Developing","severity":"high","affected":[],"headline":null,"born":"2026-11-05T18:17:11.670Z","firstSignal":"2026-11-05T00:00:00.000Z","lastSignal":"2026-11-05T18:17:11.670Z","updated":"2026-11-06T00:58:29.349Z","revision":1,"life":[{"status":"Born","at":"2026-11-05T18:17:11.670Z","why":"second independent source: C6 NVD CVE API 2.0"},{"status":"Developing","at":"2026-11-05T18:17:11.670Z","why":"signals keep joining"}],"changeLog":[{"at":"2026-11-05T00:00:00.000Z","what":"First signal: C41 Red Hat Security Data"},{"at":"2026-11-05T18:17:11.670Z","what":"Born: second source, C6 NVD CVE API 2.0. Page EM-20261105-I3CC created."}],"stages":[{"name":"Disclosed","at":"2026-11-05T18:17:11.670Z","detail":"C6 NVD published"},{"name":"Scored","at":"2026-11-05T18:17:11.670Z","detail":"CVSS 8.8"},{"name":"Exploited","at":null,"detail":"No exploitation reported"},{"name":"Advisories","at":null,"detail":"None yet"},{"name":"Vendor Response","at":"2026-11-05T00:00:00.000Z","detail":"C41 published"},{"name":"Resolved","at":null,"detail":"After 14 quiet days"}],"signals":[{"at":"2026-11-05T00:00:00.000Z","source":"C41","sourceName":"Red Hat Security Data","role":"Vendor","severity":3,"title":"Red Hat: CVE-2026-97175 (important)","text":null,"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-97175.json"},{"at":"2026-11-05T18:17:11.670Z","source":"C6","sourceName":"NVD CVE API 2.0","role":"Database","severity":3,"title":"CVE-2026-97175 (CVSS 8.8)","text":"A flaw was found in the idp-auto-link authenticator of the keycloak-services component, which handles user identity federation. The issue occurs when Keycloak automatically links an incoming identity from an external provider to an existing local account based on an email address without verifying if the provider has validated that email. This can allow an attacker to take over a victim's account by using a matching unverified email address at a brokered provider.","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97175"}],"crowd":[],"reference":{"nvd":{"published":"2026-11-05T18:17:11.670","score":8.8,"severity":"HIGH","desc":"A flaw was found in the idp-auto-link authenticator of the keycloak-services component, which handles user identity federation. The issue occurs when Keycloak automatically links an incoming identity from an external provider to an existing local account based on an email address without verifying i","product":"","seen":1793913029679},"kev":null,"epss":null,"p0":false},"mergedInto":null,"publisher":"Event Monitor Cyber"}