Red Hat Build Keycloak
Don't miss out!
Thousands of developers use stack.watch to stay informed.Get an email whenever new security vulnerabilities are reported in Red Hat Build Keycloak.
By the Year
In 2026 there have been 148 vulnerabilities in Red Hat Build Keycloak with an average score of 6.1 out of ten. Last year, in 2025 Build Keycloak had 27 security vulnerabilities published. That is, 121 more vulnerabilities have already been reported in 2026 as compared to last year. However, the average CVE base score of the vulnerabilities in 2026 is greater by 0.49.
| Year | Vulnerabilities | Average Score |
|---|---|---|
| 2026 | 148 | 6.12 |
| 2025 | 27 | 5.63 |
| 2024 | 38 | 6.24 |
| 2023 | 3 | 5.63 |
It may take a day or so for new Build Keycloak vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.
Recent Red Hat Build Keycloak Security Vulnerabilities
SAML Broker One-Time Use (OTU) Bypass in Keycloak
CVE-2026-18967
6.4 - Medium
- August 06, 2026
A flaw was found in the SAML broker component of Keycloak, an identity and access management solution. When configured as a SAML broker using the IdP-Initiated flow, Keycloak fails to enforce the OneTimeUse condition in SAML assertions. This allows an attacker who captures a valid, unused assertion to replay it multiple times. Successful exploitation could allow an attacker to hijack a user's session and gain unauthorized access to the system as that user.
Authentication Bypass by Capture-replay
Keycloak DCR Allowed Proto Mapper Flaw Enables Admin Escalation
CVE-2026-15572
8.8 - High
- August 05, 2026
A flaw was found in Keycloak's Dynamic Client Registration (DCR) security policy management. The "Allowed Protocol Mapper Types" policy, which restricts which types of data mappers a client can use, fails to re-validate the mapper type during a client update if the mapper's configuration remains unchanged. An attacker with client registration privileges can exploit this by first registering an allowed mapper type with a malicious configuration and then swapping it for a restricted, high-privilege mapper type (such as one that hardcodes administrative roles). This allows the attacker to gain full administrative access to the Keycloak realm.
Object Type Confusion
Keycloak SAML Broker SSO Bypass via IdP Account Linking
CVE-2026-16442
7.4 - High
- August 05, 2026
A flaw was found in the SAML broker component of Keycloak, which is used to manage identity federation and user authentication. The issue occurs because the IdP-initiated Single Sign-On endpoint fails to check if a provider is restricted to account linking only. This allows an attacker with control over a linked upstream identity to bypass login restrictions and gain full access to a local user account.
Origin Validation Error
Keycloak Prometheus Metric Label DoS via Memory Exhaustion
CVE-2026-16100
6.5 - Medium
- August 05, 2026
A flaw was found in the user-event metrics recording of Keycloak. When metrics are enabled, the system records raw error messages from failed account operations as Prometheus metric labels. Because these error messages can include user-supplied input like nonexistent client IDs, an authenticated user can create a massive number of unique metric entries, eventually exhausting system memory and causing the service to crash or become unavailable.
Allocation of Resources Without Limits or Throttling
LDAP DN Boundary Bypass in Keycloak LDAP Storage Provider
CVE-2026-16071
5.4 - Medium
- August 05, 2026
A flaw was found in the LDAP storage provider of Keycloak, which is used to federate user identities from external directories. The issue occurs when a delegated administrator performs a search using a specific LDAP entry Distinguished Name (DN). Due to missing validation, the system allows lookups for users located outside the configured search boundary, leading to the disclosure of account information from unauthorized parts of the directory and unintended importing of those users into local storage.
Improper Privilege Management
Keycloak DCR Path Validation Flaw Enables Privilege Escalation
CVE-2026-16102
8.1 - High
- August 05, 2026
A flaw was found in the Dynamic Client Registration (DCR) component of Keycloak, an identity and access management solution. The default DCR policy fails to properly validate the claim path for User Property mappers, allowing them to write values to sensitive internal claim locations. An attacker with a standard user account and a limited Initial Access Token can exploit this to forge administrative roles in their access token. This allows the attacker to take over other clients, steal confidential secrets, and potentially gain full administrative control over the realm.
Authorization
Keycloak PathMatcher URINormalization Auth Bypass
CVE-2026-15573
8.1 - High
- August 05, 2026
A flaw was found in Keycloak's Authorization Services. The component responsible for matching request paths to security policies (PathMatcher) does not properly normalize URIs before comparison. By adding extra characters like a trailing slash or matrix parameters to a URL, an attacker can trick the system into applying a less restrictive security policy than intended. This allows an authenticated user to access administrative or restricted areas they should not have permission to see.
Improper Handling of Case Sensitivity
Red Hat Keycloak Services SAML Meta Import flaw: Signature Bypass
CVE-2026-16443
7.4 - High
- August 05, 2026
A flaw was found in the SAML metadata import functionality of the keycloak-services component, which is the core engine for identity brokering in Red Hat Build of Keycloak. When importing identity provider metadata that lacks specific usage attributes for keys, the system incorrectly disables signature validation for SAML responses even if a signing certificate is provided. This issue allows an unauthenticated attacker to forge a SAML response and gain unauthorized access to a user account by knowing their external identifier.
Improper Verification of Cryptographic Signature
Keycloak Backchannel Logout Flaw: SIGOmitted OIDC Logout
CVE-2026-18569
3.7 - Low
- August 04, 2026
A flaw was found in the backchannel logout endpoint of the keycloak-services component, which is part of the Red Hat Build of Keycloak. This component handles authentication and session management for applications. The issue occurs when an OIDC identity provider is configured to skip signature validation. In this specific setup, the system incorrectly accepts logout requests that have no cryptographic signature. An attacker who knows certain technical details about a user's session can use this flaw to force that user to be logged out, potentially disrupting their work.
Improper Verification of Cryptographic Signature
Keycloak Services Bypass of Client Policies via Confidential Client Update
CVE-2026-18573
6.5 - Medium
- August 02, 2026
A flaw was found in the keycloak-services component of Keycloak, which is used for managing authentication and authorization flows. The issue occurs when a realm administrator configures client policies to enforce specific authentication requirements on confidential clients. Due to improper evaluation of the client state during an update operation, an attacker with client management permissions can bypass these security policies by first creating a public client and then updating it to a confidential client with weaker authentication. This can result in the persistence of clients that do not comply with the intended security hardening of the realm.
AuthZ
Keycloak Time Policy Bypass via Fake Time Claims
CVE-2026-18572
6.5 - Medium
- August 02, 2026
Keycloak provides authorization services that allow administrators to restrict access to resources based on time policies (for example, only allowing access during business hours). A flaw was discovered where a user can include a fake time value in their authorization request that overrides the actual server time. This allows the user to bypass these time-based restrictions and access protected resources at unauthorized times.
AuthZ
Keycloak: FGAP V2 Allows Unauthorized User Group Additions
CVE-2026-18571
6.6 - Medium
- August 02, 2026
A flaw was found in the user creation component of Keycloak when Fine-Grained Admin Permissions V2 (FGAP V2) is enabled. This issue allows a sub-administrator with permission to create users to add those users to any group, even groups the sub-administrator is not authorized to manage. This could lead to unauthorized access to sensitive information or elevated privileges for the newly created users.
AuthZ
Red Hat Keycloak FullScopeDisabled Executor Bypass
CVE-2026-18570
5.4 - Medium
- August 02, 2026
A flaw was found in the full-scope-disabled client-policy executor within the keycloak-services component. This component is responsible for enforcing security policies during client registration and configuration in Red Hat Build of Keycloak. The issue occurs because the executor only validates the fullScopeAllowed field when it is explicitly provided in a request. By omitting this field, a delegated user can bypass the policy, resulting in a client created with full scope access. This allows the client to obtain tokens with unauthorized role mappings.
AuthZ
Keycloak keycloak-services OIDC Param Poll. Reroute Enables Session Fix
CVE-2026-18209
3.4 - Low
- July 31, 2026
A flaw was found in the keycloak-services component of Keycloak, which handles OpenID Connect (OIDC) authentication flows. The issue occurs because the security check designed to prevent HTTP parameter pollution only inspects the query portion of a redirect URL and ignores the fragment portion. When a client is configured with a wildcard redirect URI, an attacker can use this to inject duplicate security parameters into the login response. If a client application is not configured correctly, it might trust the attacker's injected data instead of the real security information from Keycloak, leading to session fixation or account confusion.
Improper Validation of Consistency within Input
Keycloak keycloak-services Hostname Validation Flaw Enables Unauth Client Mod
CVE-2026-18206
3.7 - Low
- July 31, 2026
A flaw was found in the keycloak-services component of Keycloak, which provides identity and access management services. The issue occurs when a realm administrator uses a wildcard domain (like *.example.com) to restrict which hosts can register or update clients. Due to improper validation, the system accepts any hostname that ends with the specified domain suffix, even if it is not a legitimate subdomain. An attacker who can control the reverse DNS of their connection can bypass these host-based restrictions, potentially allowing unauthorized client modifications.
Improper Input Validation
Keycloak Token Exchange Bypass: Domain Restriction Lapse
CVE-2026-18214
6.8 - Medium
- July 31, 2026
Keycloak allows users to log in using Google accounts and can be configured to only allow users from specific Google Workspace domains. A flaw was found where the token exchange feature, which allows swapping a Google token for a Keycloak token, does not check these domain restrictions. This means an attacker with a valid Google account from a different domain could bypass the security check and gain access to the Keycloak realm.
AuthZ
Keycloak GPI Prefix Check IDOR Enables Admin Access
CVE-2026-18203
6.5 - Medium
- July 31, 2026
A flaw was found in the group policy evaluation logic of Keycloak, an identity and access management solution. When a group policy is set to extend permissions to child groups, the system incorrectly uses a simple text-based prefix check to verify group membership. This allows a user who belongs to a different group with a similar starting name to bypass security checks and gain unauthorized access to administrative functions or protected resources.
AuthZ
Keycloak secure-client-uris flaw bypasses redirect URI security
CVE-2026-18211
4.2 - Medium
- July 31, 2026
A flaw was found in the secure-client-uris client policy executor within Keycloak core services. This component is responsible for enforcing security requirements on client configurations, such as requiring encrypted connections for redirect URIs. Due to an improper check that only looks at the start of a web address rather than properly verifying the host, an attacker can bypass these security restrictions by using a specially crafted domain name. This could allow an attacker to intercept sensitive authentication codes over unencrypted connections.
Improper Input Validation
Unauthorized OIDC Introspection Exposure in Keycloak Services
CVE-2026-18208
6.5 - Medium
- July 31, 2026
A flaw was found in the OIDC token introspection endpoint of the keycloak-services component. Keycloak is an open-source identity and access management solution used to secure modern applications and services. The issue occurs when a confidential client, configured to receive signed JWT introspection responses, attempts to introspect a token issued for a different audience. Although the endpoint correctly identifies the token as inactive for that client, it still returns the full set of token claims within a signed JWT field. This allows an unauthorized client to bypass audience-based restrictions and access sensitive information contained in the token.
AuthZ
Keycloak RoleContainerResource Authorization Bypass in Admin REST API
CVE-2026-16105
4.9 - Medium
- July 31, 2026
A flaw was found in the RoleContainerResource component of Keycloak. The issue occurs because certain name-based endpoints in the admin REST API do not properly enforce authorization checks when managing composite roles. This allows a delegated administrator with manage-realm permissions to remove essential child roles from built-in admin roles, potentially disrupting administrative functions within a realm.
AuthZ
Keycloak Token Exchange Bypass Ignoring Org Restriction
CVE-2026-18215
6.8 - Medium
- July 31, 2026
Keycloak provides a way to let users log in using Microsoft accounts while restricting access to a specific organization (tenant). A flaw was discovered where this restriction is ignored when using the token exchange feature. This means an attacker with a valid Microsoft token from a completely different organization could gain access to the Keycloak realm, potentially accessing sensitive data or performing unauthorized actions.
authentification
Keycloak SAML Wildcard URL Injection (CVE-2026-18217)
CVE-2026-18217
3.4 - Low
- July 31, 2026
A flaw was found in the SAML protocol implementation of Keycloak, an open-source identity and access management solution. The issue occurs when Keycloak handles SAML authentication requests using the HTTP-Redirect binding. If a client is configured with a wildcard redirect URL, an attacker can craft a request that includes malicious parameters. When a user authenticates, Keycloak appends its legitimate response to the attacker's parameters. This can cause some service providers to process the attacker's data instead of the real login information, potentially leading to a user being logged into the wrong account.
Improper Input Validation
TokenManager revocation bypass in Keycloak
CVE-2026-18218
4.2 - Medium
- July 31, 2026
A flaw was found in the TokenManager component of the Keycloak identity management service. When an administrator attempts to revoke tokens for a specific application (client) using a "not-before" policy, the revocation may be silently ignored if the overall security realm already has an older, non-zero revocation policy in place. This issue can allow previously issued tokens to remain valid for refreshing sessions and accessing user information even after an administrator has attempted to invalidate them.
AuthZ
Keycloak Admin API Allows Identity Provider Linking Without Org Admin Privileges
CVE-2026-18201
5.5 - Medium
- July 29, 2026
Keycloak provides a way to manage identity providers and organizations through its administrative API. A flaw was discovered where an administrator with permission to manage identity providers could link a new provider to an organization without having the required permissions to manage that organization. This could allow an unauthorized administrator to influence how users log into specific organizations.
AuthZ
Keycloak Client Policy Bypass via Group Name Match
CVE-2026-18207
6.5 - Medium
- July 29, 2026
A flaw was found in the client policy enforcement mechanism of Keycloak. The issue occurs when the system checks group membership by name instead of a unique identifier. An attacker with client management privileges could bypass security policies by joining a group with a matching name in a different part of the group hierarchy, potentially allowing them to register or update clients without following required security hardening profiles.
AuthZ
Keycloak role-users endpoint leaks user info due to missing admin permission
CVE-2026-17059
6.5 - Medium
- July 24, 2026
A flaw was found in the role-users endpoint of the keycloak-services library, which is the core component of the Keycloak identity and access management solution. The issue occurs because the system fails to check if an administrator has permission to view individual users when listing members of a role. This allows a restricted administrator to see private information, such as names and email addresses, for users they should not be able to access.
Insecure Direct Object Reference / IDOR
Keycloak Admin REST API: View-Only Admins Can Leak Client Secrets
CVE-2026-17048
5.5 - Medium
- July 24, 2026
A flaw was found in the Keycloak Admin REST API, which is used to manage security realms and clients. The issue occurs when the system processes requests for rotated client secrets that are stored in a secure vault. Due to improper boundary enforcement, a delegated administrator with view-only permissions can retrieve the actual resolved secret instead of the vault placeholder, leading to the exposure of sensitive credentials.
Information Disclosure
KeycloakServices auth endpoint leaks recaptcha keys via config VIEW only
CVE-2026-16104
4.3 - Medium
- July 17, 2026
A flaw was found in the authentication configuration endpoint of the keycloak-services component, which is the core engine for Red Hat Build of Keycloak identity and access management. The issue occurs because the system fails to mask sensitive configuration values, such as reCAPTCHA secret keys, when they are requested by administrators with view-only permissions. This can lead to the exposure of third-party service credentials to unauthorized personnel or through administrative logs.
Insufficiently Protected Credentials
Brute-Force Token Redemption Loophole in Keycloak CIBA (keycloak-services)
CVE-2026-16103
4.3 - Medium
- July 17, 2026
A flaw was found in the keycloak-services component of Keycloak. This issue is an incomplete fix for CVE-2026-9798, where brute-force protection checks were added to the Client-Initiated Backchannel Authentication (CIBA) initiation handler but were omitted from the token redemption handler. This allows an attacker with valid client credentials to obtain access and refresh tokens for a user account that has been locked due to brute-force protection, provided the authentication request was started before the lockout occurred and was approved by the user.
Improper Enforcement of Behavioral Workflow
Keycloak Admin API: RBAC Bypass Removing Composite Roles
CVE-2026-16106
4.9 - Medium
- July 17, 2026
A flaw was found in the admin REST API of Keycloak, a solution for identity and access management. The issue occurs when a delegated administrator attempts to remove a child role from a composite role. Due to missing authorization checks, an attacker with limited administrative permissions can remove privileged roles they are not authorized to manage, leading to a loss of access for other users and administrators.
AuthZ
Keycloak Default-Group Disclosure via Delegated Admin
CVE-2026-16108
4.3 - Medium
- July 17, 2026
A flaw was found in the default-groups REST endpoint and realm representation of Keycloak. This component is responsible for managing groups that are automatically assigned to new users within a realm. The issue allows a delegated administrator with realm-viewing permissions to see the names and identifiers of hidden default groups, even if they lack the specific permissions to view those groups. This can lead to the exposure of sensitive organizational structures or internal group names.
Information Disclosure
Bypass Keycloak Client Policies Signed JWT Enforcement
CVE-2026-16093
5.4 - Medium
- July 17, 2026
Keycloak provides a mechanism called Client Policies to enforce security requirements on clients, such as requiring them to use signed JWTs for authentication. A flaw was discovered where this enforcement can be bypassed. An attacker with valid client credentials can provide a fake, unsigned assertion header that tricks the system into thinking the policy requirements have been met. This allows the attacker to authenticate using simpler methods like a client secret even when the administrator has mandated more secure, signed assertions.
Reliance on Untrusted Inputs in a Security Decision
Keycloak Services OAuth 2.0 Code Binding Flaw (Red Hat)
CVE-2026-16089
5.4 - Medium
- July 17, 2026
A flaw was found in the keycloak-services component of Red Hat Build of Keycloak. The issue occurs because OAuth 2.0 authorization codes are not properly bound to the client that originally requested them. An attacker who can intercept an authorization code can modify it to be redeemed by their own client, potentially allowing them to obtain access tokens for a victim's identity.
Session Fixation
Keycloak OrgMgmt API Bypass: Unauthorized Injection via Invitation Link
CVE-2026-16072
4.9 - Medium
- July 17, 2026
A flaw was found in the organization management component of Keycloak. A delegated administrator with permission to manage organizations can create an invitation for a non-existent email address and then retrieve the secret registration link directly through the application programming interface. By using this link, the administrator can create new user accounts and add them to the organization without having the required user management permissions or access to the invited email account. This allows an administrator to bypass security boundaries and add unauthorized members to an organization.
Authorization
Keycloak keycloak-services: OIDC IDP Secret Leakage via Masked Client Secret
CVE-2026-15943
5.5 - Medium
- July 17, 2026
A flaw was found in the Keycloak keycloak-services component, which handles the management of identity providers. The issue occurs when a delegated administrator updates an OIDC identity provider using a masked client secret sentinel value. Due to improper validation, Keycloak reuses the existing real secret even if security-sensitive fields like the token URL have been changed, allowing an attacker to redirect and capture the secret.
Improper Validation of Consistency within Input
Keycloak FGAP v2 Bypass: Delegated Admin Exposes Parent Group Data
CVE-2026-15945
4.3 - Medium
- July 16, 2026
A flaw was found in the group search functionality of the Keycloak server's administrative API. When Fine-Grained Admin Permissions (FGAP) v2 is enabled, a delegated administrator can bypass access restrictions to view parent groups they are not authorized to see. By searching for a child group they have permission to view, the system incorrectly returns the full details of the parent group in the response, leading to the disclosure of sensitive group attributes and configuration.
Insecure Direct Object Reference / IDOR
Keycloak OIDC Broker Email-Verified Claim Bypass
CVE-2026-14781
4.8 - Medium
- July 05, 2026
A flaw exists in the org.keycloak.broker.oidc package where the OIDC broker incorrectly synchronizes the email_verified claim. When an OIDC identity provider is configured with trustEmail=true and the userinfo endpoint is enabled, Keycloak retrieves the email address from the userinfo response but retrieves the email_verified status exclusively from the id_token. The root cause is a lack of validation ensuring that the email_verified claim in the id_token actually refers to the email address returned by the userinfo endpoint. If these two sources return different email addresses, the id_token's email_verified=true claim is blindly applied to the userinfo email. Exploitation Conditions: The OIDC identity provider must have trustEmail set to true (non-default). The userinfo endpoint must be enabled (default). The attacker must control or have compromised the upstream OIDC provider. Concrete Impact: Mark arbitrary email addresses as verified in the Keycloak database. Bypass email-based security controls or verification workflows. Potential account takeover if the application relies solely on the email_verified flag from the IdP to link accounts.
Improper Validation of Consistency within Input
Admin Permission Leak in Keycloak FGAP v2
CVE-2026-14615
4.3 - Medium
- July 03, 2026
A flaw was found in the Fine-Grained Admin Permissions (FGAP) v2 implementation within Keycloak's administrative services. When FGAP v2 is enabled, the system fails to properly filter child groups based on the caller's specific permissions when requested through a parent group. This allows a delegated administrator to view details of child groups they are not authorized to access directly, including group names, paths, and custom attributes.
Insufficient Granularity of Access Control
Keycloak ClientResource Permission Bypass via FGAP v2
CVE-2026-14614
5.4 - Medium
- July 03, 2026
A flaw was found in the ClientResource component of Keycloak's admin services when Fine-Grained Admin Permissions (FGAP) v2 is enabled. This issue allows a delegated administrator, who should only have limited control over specific clients, to attach or remove hidden client scopes that they are not authorized to see or manage. As a result, an attacker could inject unauthorized data or permissions into the security tokens issued to end-users, potentially tricking other applications into granting higher levels of access than intended.
Insecure Direct Object Reference / IDOR
Keycloak FGAP v2: Admin RLS Bypass Exposes Hidden Groups
CVE-2026-14613
4.3 - Medium
- July 03, 2026
A vulnerability was discovered in Keycloak's administrative interface that allows certain administrators to see information about groups they shouldn't have access to. When the new Fine-Grained Admin Permissions (FGAP v2) are turned on, an administrator who is allowed to see a specific "role" can also see a list of all groups assigned to that role. The system fails to check if the administrator has permission to see those specific groups. This could allow a restricted administrator to discover "hidden" groups and see their details, such as internal names and custom settings, which might contain sensitive deployment information.
Authorization
Keycloak Privilege Escalation via Role Mapper Injection
CVE-2026-4629
6.5 - Medium
- June 30, 2026
A flaw was found in Keycloak. A highly privileged user with `manage-clients` permission can exploit this vulnerability by injecting a hardcoded role mapper into any client. This action allows the user to bypass existing scope restrictions and inject the `realm-admin` role into generated tokens, resulting in privilege escalation and full administrative access to the realm.
Incorrect Privilege Assignment
Privilege Escalation in Keycloak via Hardcoded Role Mapper
CVE-2026-12388
6.5 - Medium
- June 30, 2026
A flaw was found in the Identity Provider (IdP) mapper component of Keycloak, which is used to manage how user information from external services is mapped to Keycloak users. An administrator with limited permissions to manage identity providers can exploit this flaw by creating a "Hardcoded Role" mapper that assigns high-level administrative roles (like realm-admin) to themselves or others. This allows a restricted administrator to bypass security checks and gain full control over the entire realm.
Incorrect Privilege Assignment
Keycloak Admin UI: FGAP bypass via brute-force-user endpoint
CVE-2026-14209
4.3 - Medium
- June 30, 2026
A vulnerability was discovered in Keycloak's Admin UI extension that allows certain administrative users to bypass security restrictions. When Fine-Grained Admin Permissions (FGAPv2) are enabled, an administrator who should only be able to search for users (but not view their full details) can use a specific "brute-force-user" endpoint to access a user's full profile. This includes sensitive information and security metadata. The issue occurs because the system fails to check if the administrator has the required "view" permission for that specific user when using this particular search path.
Insecure Direct Object Reference / IDOR
Keycloak JWT Algorithm Confusion Bypass Via Authorization Grant
CVE-2026-11800
8.1 - High
- June 25, 2026
A flaw was found in Keycloak. This JWT algorithm confusion vulnerability in the JWT Authorization Grant flow allows an attacker with valid client credentials to bypass signature verification. By forging an assertion, the attacker can create unauthorized access tokens. This enables the attacker to impersonate any federated user linked to the affected Identity Provider, leading to unauthorized access and potential privilege escalation.
Improper Verification of Cryptographic Signature
Keycloak: Arbitrary File Path Disclosure via Keystore Param
CVE-2026-9083
4.9 - Medium
- June 25, 2026
A flaw was found in Keycloak. A realm administrator with the "manage-realm" role can exploit this vulnerability by submitting an arbitrary filesystem path as a keystore parameter when creating a key provider component. This allows the administrator to probe arbitrary filesystem paths, determining which files exist and are readable by the Keycloak process. This information disclosure could be used to identify high-value targets for follow-on attacks.
Directory traversal
Keycloak UMA Prefix Bypass Grants Unauthorized Access Under PERMISSIVE Mode
CVE-2026-9799
4.6 - Medium
- June 25, 2026
A flaw was found in org.keycloak.authorization. An authenticated user with a granted User-Managed Access (UMA) permission ticket for one resource can exploit this by using a specific permission request prefix to bypass per-resource access control. This allows the user to gain unauthorized access to all resources of that type within the same resource server, even if they do not have a ticket for those specific resources. This vulnerability requires the resource server to be configured in PERMISSIVE policy enforcement mode and affects typed resources with ownerManagedAccess enabled, where no explicit policy protects the resource type. The primary consequence is unauthorized information disclosure or modification of resources.
Insecure Direct Object Reference / IDOR
Keycloak RAT Allows Reenable Client
CVE-2026-9705
6.5 - Medium
- June 25, 2026
A flaw was found in Keycloak's client registration service. A remote attacker, possessing a previously issued Registration Access Token (RAT), could exploit this vulnerability to re-enable a client that an administrator had explicitly disabled. This bypasses security controls, allowing the attacker to reset the client's secret and potentially regain privileged API access. The primary impact includes unauthorized information disclosure and potential integrity compromise.
Insufficient Session Expiration
Keycloak Client Redirect URI Validation Bypass XSS (CVE-2026-9086)
CVE-2026-9086
7.3 - High
- June 25, 2026
A flaw was found in Keycloak. A remote attacker with administrative privileges, specifically those with `manage-client` permission or access to client registration endpoints, could bypass client Uniform Resource Identifier (URI) validation. This is achieved by registering a malicious client with a specially crafted redirect URI using a case-insensitive `javascript:` or `data:` scheme. This Cross-Site Scripting (XSS) vulnerability allows for arbitrary code execution in the Keycloak origin when a victim clicks the crafted link, such as in the logout flow or the Admin Console.
XSS
Keycloak Admin API: Missing Auth Checks in GroupResource.addChild
CVE-2026-9099
7.7 - High
- June 25, 2026
A flaw was found in Keycloak. A missing authorization check in the GroupResource.addChild() endpoint within the Admin REST API allows an authenticated user with limited administrative privileges to reparent any existing group. When Fine-Grained Admin Permissions v2 (FGAPv2) is enabled, an attacker with management rights over a single low-privilege group can reparent a highly privileged group (such as one possessing the realm-admin role) under their managed group. Because group permissions follow a hierarchical structure, this action unauthorizedly grants the attacker management and password-reset capabilities over the members of the targeted privileged group. An attacker can exploit this to reset an administrator's password, compromise the account, and achieve a full realm takeover, leading to a complete compromise of confidentiality, integrity, and availability.
Insecure Direct Object Reference / IDOR
Keycloak Policy Enforcer Auth Bypass via Access-Denied Page Injection
CVE-2026-9800
8.1 - High
- June 25, 2026
A flaw was found in Keycloak Policy Enforcer. This vulnerability allows any authenticated user to bypass all authorization policies, including role, scope, and User-Managed Access (UMA) permission checks. By including the configured access-denied page path within a request URL, either as a path segment or a query parameter, an attacker can gain unauthorized access to protected resources.
Comparison Using Wrong Factors
Stay on top of Security Vulnerabilities
Want an email whenever new vulnerabilities are published for Red Hat Build Keycloak or by Red Hat? Click the Watch button to subscribe.
