AIKIDO-2026-990736

TL;DR

The legacy client-initiated account-linking endpoint at /realms/{realm}/broker/{provider}/link protects requests with a SHA-256 hash built from a nonce, the user session id, the client id, and the identity-provider alias. A malicious OIDC client that can observe or predict those inputs can forge a valid linking URL, and after tricking the victim into authenticating it links the victim's account to an attacker-controlled external identity. That yields full account takeover so the attacker can sign in as the victim. The fix disables the legacy endpoint by default and requires migrating to Application-Initiated Actions (idp_link).