A flaw was found in the keycloak-services component, specifically within the legacy client-initiated account-linking endpoint (/realms/{realm}/broker/{provider}/link). The endpoint validates a CSRF protection hash computed as SHA-256(nonce + userSessionId + clientId + providerAlias).
The root cause is that all four inputs to this hash are accessible to a registered OIDC client:
nonce is chosen by the attacker.

userSessionId is leaked as the session_state parameter in standard OIDC authorization responses (handled by OIDCLoginProtocol.java).

clientId and providerAlias are known to the client.


By obtaining the victim's session_state during a normal login flow, a malicious client can compute the required hash and generate a valid account-linking URL. If the client has the manage-account-links role (granted by default via fullScopeAllowed=true), the attacker can silently link their own upstream Identity Provider (IdP) identity to the victim's Keycloak account.
Concrete Impact:
Account Takeover: Attacker gains full access to the victim's account by logging in via the newly linked IdP.

Unauthorized Identity Linking: Attacker can link multiple malicious identities to a single victim account.

Data Exfiltration: Attacker can access all applications and data the victim is authorized to see.