CVE-2026-14781 - Keycloak OIDC Broker Vulnerability in Service Virtualization (DevTest) IAM

Products

• Service Virtualization

Issue/Introduction

A security flaw has been identified in the org.keycloak.broker.oidc package within the integrated Keycloak server used by the Identity and Access Management (IAM) component of Service Virtualization (DevTest).

When an OIDC identity provider is configured with trustEmail=true and the userinfo endpoint is enabled, Keycloak correctly retrieves the email address from the userinfo response but retrieves the email_verified status exclusively from the id_token. The root cause is a lack of validation ensuring that the email_verified claim in the id_token corresponds to the email address returned by the userinfo endpoint.

If these two sources return different email addresses, the id_token's email_verified=true claim is applied to the userinfo email, potentially bypassing email-based security controls or verification workflows.

Vulnerability Details

• CVE-ID: CVE-2026-14781
• CVSS Score: 4.8 (Medium)

• Exploitation Conditions:
  • The OIDC identity provider must have trustEmail set to true (non-default).
  • The userinfo endpoint must be enabled (default).
  • The attacker must control or have compromised the upstream OIDC provider.
• Impact: Mark arbitrary email addresses as verified in the Keycloak database. Potential account takeover if the application relies solely on the email_verified flag from the Identity Provider (IdP) to link accounts.

Environment

• Product: Service Virtualization (DevTest)
• Component: Identity and Access Management (IAM) / Keycloak integration

Resolution

Broadcom Engineering has addressed this vulnerability by implementing validation to ensure the email_verified status is correctly tied to the validated email address. The fix is scheduled for integration in the following release:

• Service Virtualization (DevTest) 10.9.3

Remediation Steps

1. Plan Upgrade: Schedule an upgrade of your Service Virtualization (DevTest) environment to version 10.9.3 or later.
2. Apply Update: Once the release becomes available, update the Identity Access Manager (IAM) component of your installation to the target version.
3. Verification: Confirm that the IAM component is running the version provided in the 10.9.3 release to ensure the vulnerability is mitigated.