Impersonation and lockout are possible due to email trust not being handled correctly in Keycloak. Since the verified state is not reset when the email changes, it is possible for users to shadow others with the same email and lock out or impersonate them. Step-by-Step Reproducer: 1. Set up a Keycloak instance with a 'customer' realm 2. Create a ‘shared’ realm where the 'customer' realm is linked as an identity provider. 3. Disable the ‘Trust email’ configuration option in the ‘shared’ realm. 4. Create a new user in the 'customer' realm and log in to the ‘shared’ realm. 5. Verify that the user is prompted to verify their email address. 6. Update the email address of the user in the customer realm and log in to the ‘shared’ realm. 7. Verify that the email address attribute is updated but remains verified.
This issue has been addressed in the following products: Red Hat Single Sign-On 7.6 for RHEL 9 Via RHSA-2023:7484 https://access.redhat.com/errata/RHSA-2023:7484
This issue has been addressed in the following products: Red Hat Single Sign-On 7.6 for RHEL 7 Via RHSA-2023:7482 https://access.redhat.com/errata/RHSA-2023:7482
This issue has been addressed in the following products: Red Hat Single Sign-On 7.6 for RHEL 8 Via RHSA-2023:7483 https://access.redhat.com/errata/RHSA-2023:7483
This issue has been addressed in the following products: RHEL-8 based Middleware Containers Via RHSA-2023:7486 https://access.redhat.com/errata/RHSA-2023:7486
This issue has been addressed in the following products: Red Hat Single Sign-On Via RHSA-2023:7488 https://access.redhat.com/errata/RHSA-2023:7488