Description
A flaw was found in the AAP gateway. The user auto-link strategy, introduced in AAP 2.6, automatically links an external Identity Provider (IDP) identity to an existing AAP user account based on email matching without verifying email ownership. This allows a remote attacker to potentially hijack a victim's account or gain unauthorized access to other accounts, including administrative accounts, by manipulating the IDP-provided email.
Problem types
Authentication Bypass by Primary Weakness
Product status
0:4.6.28-3.el8ap (rpm) before *
0:2.5.20260422-2.el8ap (rpm) before *
0:2.5.20260422-2.el8ap (rpm) before *
0:4.6.28-3.el9ap (rpm) before *
0:2.5.20260422-2.el9ap (rpm) before *
0:2.5.20260422-2.el9ap (rpm) before *
0:4.7.11-2.el9ap (rpm) before *
0:2.6.20260422-1.el9ap (rpm) before *
0:2.6.20260422-1.el9ap (rpm) before *
1777377014 (rpm) before *
1777311120 (rpm) before *
Timeline
| 2026-04-14: | Reported to Red Hat. |
| 2026-05-04: | Made public. |
Credits
This issue was discovered by Robin Bobbitt (Red Hat).
References
access.redhat.com/errata/RHSA-2026:13508 (RHSA-2026:13508)
access.redhat.com/errata/RHSA-2026:13512 (RHSA-2026:13512)
access.redhat.com/errata/RHSA-2026:13545 (RHSA-2026:13545)
access.redhat.com/security/cve/CVE-2026-6266
bugzilla.redhat.com/show_bug.cgi?id=2458142 (RHBZ#2458142)