Red Hat Build Keycloak
Don't miss out!
Thousands of developers use stack.watch to stay informed.Get an email whenever new security vulnerabilities are reported in Red Hat Build Keycloak.
By the Year
In 2026 there have been 241 vulnerabilities in Red Hat Build Keycloak with an average score of 6.3 out of ten. Last year, in 2025 Build Keycloak had 27 security vulnerabilities published. That is, 214 more vulnerabilities have already been reported in 2026 as compared to last year. However, the average CVE base score of the vulnerabilities in 2026 is greater by 0.63.
| Year | Vulnerabilities | Average Score |
|---|---|---|
| 2026 | 241 | 6.26 |
| 2025 | 27 | 5.63 |
| 2024 | 38 | 6.24 |
| 2023 | 3 | 5.63 |
It may take a day or so for new Build Keycloak vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.
Recent Red Hat Build Keycloak Security Vulnerabilities
Keycloak client management auth bypass enabling JS policy injection
CVE-2026-120984
9.1 - Critical
- November 07, 2026
A flaw was found in the Keycloak server's client management component. When a client is created or imported with authorization services enabled, the system fails to properly clear an internal session attribute used during the setup process. This allows an authenticated attacker with client management permissions to bypass security controls and upload a malicious JavaScript policy, which is then executed on the server when an authorization request is made. Successful exploitation could allow the attacker to run arbitrary code on the server, potentially compromising the entire system.
Code Injection
Keycloak Admin Privilege Escalation via JWKS Manipulation (CVE-2026-9797)
CVE-2026-9797
6.5 - Medium
- November 06, 2026
A flaw was found in Keycloak's administrative services (org.keycloak.services.resources.admin). A highly privileged attacker, authenticated with a 'manage-clients' role, could exploit this vulnerability through several methods, including manipulating client JSON Web Key Sets (JWKS), swapping client authenticator types and resetting secrets, or downloading legitimate signing keys. Successful exploitation allows the attacker to obtain a token with 'realm-admin' role assignments, leading to privilege escalation and potential unauthorized access to sensitive resources.
Incorrect Privilege Assignment
Keycloak JSON Mapper Token Sanitization Bypass (Role Injection)
CVE-2026-97848
6.5 - Medium
- November 06, 2026
A flaw was found in the token sanitization logic of Keycloak, an open source identity and access management solution. The issue occurs when a protocol mapper is configured to emit structured claims using the JSON type. The security check designed to remove unauthorized role mappings only looks for standard Java maps and fails to recognize Jackson based JSON objects. This allows an attacker to inject forged client roles into security tokens, which could lead to unauthorized access to protected resources.
Improper Input Validation
Keycloak Account REST API Session Hijack via Token Manipulation
CVE-2026-97367
6.4 - Medium
- November 06, 2026
A flaw was found in the Keycloak Account REST API where it incorrectly handles session identification. A malicious client owner can manipulate their own security tokens to point to a different user's active session. This allows the attacker to access and modify the victim's account information, potentially leading to a full account takeover by changing the recovery email and resetting the password.
authentification
Keycloak DCR Claim Name Restriction Bypass (Privilege Escalation)
CVE-2026-96547
6.5 - Medium
- November 06, 2026
A flaw was found in the Dynamic Client Registration component of Keycloak, an open-source identity and access management solution. The issue occurs because the system does not properly restrict which claim names can be used when setting up new clients. An attacker with valid registration credentials could create a client that incorrectly maps standard user profile information to sensitive security roles, potentially allowing them to gain unauthorized privileges on external applications that trust Keycloak tokens.
AuthZ
Keycloak Token Exchange V2 Unlimited Lifetime Vulnerability
CVE-2026-96460
5.4 - Medium
- November 06, 2026
A flaw was found in the token exchange mechanism of Keycloak. When using Standard Token Exchange V2, the system issues new tokens with a fresh lifetime based on the requester clients configuration instead of limiting it to the original tokens expiration. This issue allows an authenticated requester to indefinitely extend access for service accounts by repeatedly exchanging tokens, even if the original client has been disabled by an administrator.
Incorrect Implementation of Authentication Algorithm
Keycloak SAML brokering ProxyRestriction bypass (CVE-2026-92856)
CVE-2026-92856
4.9 - Medium
- November 06, 2026
A flaw was found in the SAML brokering component of Keycloak, an identity and access management solution. The issue occurs when Keycloak acts as an intermediary between an upstream identity provider and downstream services. Keycloak fails to respect specific security instructions called ProxyRestrictions in the login messages it receives. This allows a user to log into downstream services even when the original identity provider explicitly forbade further sharing of the login session. As a result, users can bypass security boundaries intended to limit where their identity can be used.
AuthZ
Keycloak Admin API Token Audience Validation Bypass (CVE-2026-19688)
CVE-2026-19688
6.8 - Medium
- November 06, 2026
A flaw was found in the Admin REST API of Keycloak, an identity and access management solution. The Admin API fails to verify the intended audience of bearer tokens during authentication. This issue allows an attacker who operates a client within a realm to capture an administrator's access token and reuse it to perform unauthorized administrative actions, potentially leading to full realm compromise.
authentification
Keycloak TokenManager Stateless Token Validation Bypass
CVE-2026-96447
4.2 - Medium
- November 06, 2026
A flaw was found in the TokenManager component of Keycloak, an open-source identity and access management solution. The issue occurs during the validation of stateless access tokens when the original user ID no longer exists. Keycloak incorrectly falls back to using the username to identify the user without verifying if the identity matches the original token subject. This could allow an attacker with an old token to gain access to a newly created service account if it shares the same client ID as a previously deleted one.
authentification
Keycloak DCR endpoint auth bypass leads to role injection DoS
CVE-2026-109081
6.8 - Medium
- November 06, 2026
A flaw was found in Keycloak. The Dynamic Client Registration (DCR) endpoint does not properly validate authorization when processing the deprecated defaultRoles field. An authenticated attacker with client creation privileges or an Initial Access Token (IAT) can inject excessive roles into the realm's default roles configuration. This causes clients across the realm to generate bloated access tokens, resulting in performance and memory degradation that can lead to a Denial of Service (DoS).
AuthZ
Keycloak OIDC Logout Session Fixation via Unvalidated Token Hint
CVE-2026-107124
6.4 - Medium
- November 06, 2026
A flaw was found in the OIDC logout endpoint of the keycloak-services component, which handles user session termination in Red Hat Build of Keycloak. The issue occurs because the system sets a session cookie based on an unvalidated token hint before completing security checks. An attacker can use this flaw to fix a session ID in a victim's browser, allowing them to hijack the victim's subsequent login and gain full control over their account.
Session Fixation
Keycloak Protocol Mapper Identity Resolution Bug (CVE-2026-97847)
CVE-2026-97847
7.1 - High
- November 05, 2026
A flaw was found in the protocol mapper and identity resolution components of Keycloak. The issue occurs when a client manager uses hardcoded-claim mappers to override identity claims in sessionless service-account tokens. Because these tokens lack a session ID, Keycloak may incorrectly resolve the token bearer as a different, highly privileged user based on the manipulated claims. This can allow an attacker with limited client management permissions to impersonate a realm administrator and gain full control over the realm.
authentification
Keycloak idp-auto-link Authenticator Account Takeover via Unverified Email
CVE-2026-97175
8.8 - High
- November 05, 2026
A flaw was found in the idp-auto-link authenticator of the keycloak-services component, which handles user identity federation. The issue occurs when Keycloak automatically links an incoming identity from an external provider to an existing local account based on an email address without verifying if the provider has validated that email. This can allow an attacker to take over a victim's account by using a matching unverified email address at a brokered provider.
authentification
Keycloak CIBA sub parameter injection leads to token substitution
CVE-2026-97174
6.8 - Medium
- November 05, 2026
A flaw was found in the Client-Initiated Backchannel Authentication (CIBA) implementation of Keycloak. The CIBA endpoint fails to properly validate the sub parameter, allowing it to be stored as an additional request parameter. During the token issuance process, this injected value overwrites the legitimate subject identifier. This allows an attacker to authenticate as themselves but receive security tokens belonging to a different victim user, leading to unauthorized account access.
Improper Input Validation
Keycloak kcadm CLI Truststore Hostname Validation Bypass
CVE-2026-96453
8 - High
- November 05, 2026
A flaw was found in the Keycloak Admin CLI kcadm tool, which is used by administrators to manage Keycloak servers from the command line. When a custom truststore is provided to verify the server identity, the tool incorrectly accepts any self-signed certificate as long as the hostname matches. This allows a network attacker to impersonate the Keycloak server, steal administrative credentials, and perform unauthorized management actions.
Improper Certificate Validation
Keycloak SAML Adapter Issuer Mismatch (CVE-2026-93998)
CVE-2026-93998
7.4 - High
- November 05, 2026
A flaw was found in the SAML adapter component of Keycloak, which is used to secure applications with SAML-based authentication. The adapter fails to verify that the issuer of a signed SAML assertion matches the expected identity provider configured for the application. If multiple identity providers share the same trusted signing key, an attacker who controls one of those providers can create a validly signed assertion to log into the application as any user, potentially gaining full administrative control.
Improper Verification of Cryptographic Signature
Keycloak DCR Validation Bypass Allows Token Forgery
CVE-2026-92857
8.1 - High
- November 05, 2026
Keycloak provides a Dynamic Client Registration feature that allows users with specific tokens to register their own applications. A flaw in how Keycloak validates these registration requests allows an attacker to create a malicious application that forges identity information. By mapping their own user profile details to protected fields like the user ID (sub) or intended audience (aud), an attacker can generate signed security tokens that make them appear to be a different user. This could allow an attacker to impersonate other users or gain unauthorized access to services that rely on these tokens for identity verification.
Improper Input Validation
Keycloak SAML broker holder-of-key assertion replay flaw
CVE-2026-92855
7.4 - High
- November 05, 2026
A flaw was found in the SAML identity broker component of Keycloak, which is used to delegate authentication to external identity providers. The issue occurs because the broker fails to verify that a user actually possesses the private key associated with a holder-of-key assertion. An attacker who intercepts a victim signed assertion can replay it to gain unauthorized access and impersonate the victim without needing their private key.
authentification
Keycloak SAML XML DoS via Unbounded Artifact/ECP Requests
CVE-2026-82965
7.5 - High
- November 05, 2026
A flaw was found in the SAML implementation of Keycloak, an open-source identity and access management solution. The SAML Artifact Resolution and ECP SOAP endpoints do not properly limit the size or complexity of incoming XML requests. An unauthenticated remote attacker can exploit this by sending specially crafted, large XML messages that cause the server to consume excessive memory. This leads to the application running out of memory and crashing, resulting in a denial of service for all users.
Resource Exhaustion
CVE-2026-114232: Keycloak UMA Policy ResourceType Validation Bypass
CVE-2026-114232
8.1 - High
- November 05, 2026
A flaw was found in the UserManagedPermissionService of the Keycloak authorization server. The UMA Protection API, which manages user permissions, fails to validate the resourceType field when a user creates a new policy. This allows an attacker to create a policy that applies to resources owned by other users, potentially leading to unauthorized access or modification of sensitive data across the entire realm.
AuthZ
Keycloak Org Identity Login Flow Stale Flag Auth Bypass (CVE-2026-112208)
CVE-2026-112208
8.1 - High
- November 05, 2026
A flaw was found in the Organization identity-first login flow of the Keycloak authentication server. Keycloak is an open-source identity and access management solution used to secure modern applications and services. The issue occurs when an attacker who belongs to multiple organizations initiates a login and then switches to a registration or password reset path. During this process, a flag indicating a successful login is not properly cleared when the user is removed from the session. An attacker can then provide a victim's username, and the system incorrectly treats the stale flag as proof of the victim's identity. This allows the attacker to bypass authentication and gain full access to the victim's account and connected applications.
Authentication Bypass by Primary Weakness
Keycloak Theme Endpoint Disk Exhaustion (DoS)
CVE-2026-110932
7.5 - High
- November 05, 2026
A flaw was found in the theme resource endpoint of Keycloak, an open-source identity and access management solution. The issue occurs because the server fails to validate theme names before using them as keys for an on-disk gzip cache. An unauthenticated attacker can exploit this by sending many requests with unique, fabricated theme names, leading to persistent disk space exhaustion that survives server restarts and causes service disruptions.
Resource Exhaustion
Keycloak SAML 1.1 Assertion Parser Infinite Loop DoS (CVE2026110931)
CVE-2026-110931
7.5 - High
- November 05, 2026
A flaw was found in the SAML 1.1 assertion parser of Keycloak, a tool used for identity and access management. The issue occurs when the parser handles a specific element called AuthorityBinding within an authentication statement. Due to an incomplete fix for a previous vulnerability, the parser can enter an infinite loop that consumes all available memory, causing the entire Keycloak service to crash and become unavailable to users.
Infinite Loop
Keycloak SAML 1.1 XML Parsing Infinite Loop DoS
CVE-2026-107602
7.5 - High
- November 05, 2026
A flaw was found in the SAML 1.1 XML parsing logic of Keycloak, an open-source identity and access management solution. The issue occurs when the parser encounters unexpected elements within a security token's key information section, causing the processing thread to enter an infinite loop. An unauthenticated remote attacker could exploit this by sending specially crafted requests, leading to 100% CPU usage and a total denial of service that requires a server restart to resolve.
Infinite Loop
Keycloak SAML XML DoS (CPU) via oversized dateTime/duration
CVE-2026-107123
7.5 - High
- November 05, 2026
A flaw was found in the SAML XML processing component of Keycloak, an open-source identity and access management solution. The issue occurs when the server parses XML documents containing excessively long dateTime or duration values. Because these strings are not properly validated before processing, the XML parser consumes excessive CPU time. An unauthenticated remote attacker can exploit this by sending specially crafted SAML requests to the server, leading to high CPU utilization and a denial of service for all users.
Resource Exhaustion
Keycloak keycloak-services Auth Session Race Condition
CVE-2026-103112
7.5 - High
- November 05, 2026
A flaw was found in the authentication session handling of the keycloak-services component in Keycloak. The issue occurs because the system fails to verify if an authenticator is valid for the current authentication flow when switching between the standard authentication path and the reset credentials path. An authenticated attacker can exploit this by triggering a race condition during the credential reset process to associate their successful authentication state with another user's session. This can result in the attacker gaining full access to the victim's account and changing their password.
Race Condition
Keycloak SAML HTTP-Redirect Binding Percent-Encode Parameter Bypass
CVE-2026-117691
9.1 - Critical
- November 05, 2026
A flaw was found in the SAML HTTP-Redirect binding implementation of Keycloak. The issue occurs because the server processes percent-encoded parameter names (like %53AMLResponse) while the signature verification logic only checks literal parameter names. An attacker can use this discrepancy to provide a crafted, unsigned SAML message that the server processes instead of a legitimately signed one, leading to full account takeover of federated users.
Improper Verification of Cryptographic Signature
Quarkus vertx-http Auth Bypass via Miscombined Management Path
CVE-2026-107912
7.7 - High
- November 05, 2026
A flaw was found in the management interface of the Quarkus framework, specifically within the quarkus-vertx-http component. The issue occurs when the framework incorrectly combines the management root path with specific permission rules, leading to a situation where security policies are applied to the wrong internal paths. As a result, an attacker can bypass intended authorization checks and gain unauthorized access to sensitive management endpoints.
AuthZ
RESTEasy 7.0.2 Final - Unhandled Exception Leak via Default Mapper
CVE-2026-120971
5.3 - Medium
- November 03, 2026
A flaw was found in RESTEasy's default exception mapper. When an unhandled exception other than a WebApplicationException is not handled by an application exception mapper, RESTEasy returns the exception's localized message in the HTTP 500 response body. A remote unauthenticated attacker who can trigger such an exception may obtain information contained in that message. The behavior was reproduced with RESTEasy 7.0.2.Final.
Generation of Error Message Containing Sensitive Information
Keycloak Action Provider Auth Bypass via kc_action (CVE-2026-118959)
CVE-2026-118959
5.4 - Medium
- October 30, 2026
A flaw was found in the required action provider mechanism of Keycloak. The issue occurs when an authorization request includes the kc_action query parameter set to a mandatory action already assigned to the user, such as profile verification or terms and conditions. Due to incorrect handling of application-initiated actions, Keycloak may skip these mandatory challenges and issue an authorization code. This can allow a user to bypass administrative requirements and gain access to the application without completing necessary profile updates or agreeing to terms.
authentification
Keycloak UMA Resource Registration Auth Bypass (CVE-2026-118947)
CVE-2026-118947
4.3 - Medium
- October 30, 2026
A flaw was found in the UMA resource registration endpoint of the keycloak-services component, which provides the core logic for Keycloak's authorization and identity services. The issue occurs when remote resource management is enabled, allowing an authenticated user with specific permissions to update resources they do not own by providing a target resource ID in a request. This can lead to unauthorized modification of resource configurations, such as names, URIs, and scopes.
Insecure Direct Object Reference / IDOR
Keycloak Secure-Redirect-URIs-Enforcer Bypass via DNS Loopback Hostname
CVE-2026-118425
6.8 - Medium
- October 29, 2026
A flaw was found in the secure-redirect-uris-enforcer client policy of Keycloak, an identity and access management solution. The issue occurs when the policy is configured to allow loopback addresses, as Keycloak resolves hostnames via DNS during validation. An attacker can bypass domain allowlist restrictions by using a hostname that resolves to a loopback address, potentially allowing the registration of unauthorized redirect URIs.
Open Redirect
Keycloak HOTP Race Condition Enables OTP Replay
CVE-2026-118030
4.2 - Medium
- October 29, 2026
A flaw was found in the HOTP authentication mechanism of the keycloak-services component, which provides identity and access management services. The issue occurs because the system validates a one-time password and updates its internal counter in two separate steps without proper locking. An attacker with a users password could exploit this timing gap to use a single one-time code to log in multiple times simultaneously.
Race Condition
Keycloak Client Reg. Secret Disclosure via Vault Ref
CVE-2026-117688
5.3 - Medium
- October 29, 2026
A flaw was found in the client registration component of Keycloak, an open-source identity and access management solution. When a vault provider is used to store sensitive information, an authenticated client owner can use a specially crafted reference to trick the system into revealing secrets. By updating a client secret to point to a vault entry and then requesting the client configuration, the owner can see the secret value in plain text. This could lead to the exposure of sensitive credentials that the user should not be able to access.
Information Disclosure
Keycloak JWT Auth Grant Bypass via OIDC Claim Filter Skipping
CVE-2026-117627
5.4 - Medium
- October 29, 2026
A flaw was found in the JWT Authorization Grant implementation of the keycloak-services component. When an OIDC or Google identity provider is configured with specific login restrictions, such as claim filtering, these checks are correctly applied during standard browser logins but are skipped during the JWT-based grant flow. This allows an authenticated client to obtain access tokens for a user even if their identity provider claims should have blocked the login.
AuthZ
A flaw was found in the Update User Locale required action of the Keycloak identity and access management solution
CVE-2026-114438
4.2 - Medium
- October 21, 2026
A flaw was found in the Update User Locale required action of the Keycloak identity and access management solution. When this action is ordered before the Configure OTP action in a realm, the system may fail to enforce mandatory multi-factor authentication enrollment during the login process. This issue allows an attacker with a valid password to access an account without setting up the required one-time password (OTP) credential.
authentification
A flaw was found in the login theme rendering component of Keycloak
CVE-2026-107889
5.5 - Medium
- October 09, 2026
A flaw was found in the login theme rendering component of Keycloak. The issue occurs because the security filter responsible for cleaning user input can be bypassed, allowing a realm administrator to store malicious scripts in display fields. This could result in unauthorized JavaScript execution in the browsers of users visiting the login page, potentially leading to data exposure or session interference.
XSS
A flaw was found in the OIDC Dynamic Client Registration (DCR) component of Keycloak
CVE-2026-107623
4.3 - Medium
- October 08, 2026
A flaw was found in the OIDC Dynamic Client Registration (DCR) component of Keycloak. A bug in the response serialization causes the backchannel logout offline token revocation setting to be omitted from responses. When a client performs a standard update, this missing information causes the setting to be silently disabled. As a result, offline tokens may remain valid even after a user session is terminated via backchannel logout.
AuthZ
A flaw was found in the SMTP email configuration handling of the keycloak-services component
CVE-2026-107121
6.5 - Medium
- October 07, 2026
A flaw was found in the SMTP email configuration handling of the keycloak-services component. When the STARTTLS option is enabled, Keycloak fails to strictly enforce an encrypted connection, allowing it to fall back to unencrypted communication if the encryption request is tampered with. An attacker who can intercept network traffic can exploit this to capture sensitive email credentials and message content in plain text.
Cleartext Transmission of Sensitive Information
A flaw was found in the OIDC implementation of Keycloak, specifically within the Device Authorization Grant flow
CVE-2026-105305
5.4 - Medium
- October 06, 2026
A flaw was found in the OIDC implementation of Keycloak, specifically within the Device Authorization Grant flow. This component allows devices with limited input capabilities to obtain security tokens. The issue occurs because the flow fails to check the minimum authentication level required by a client configuration. This allows an attacker who has stolen a user's password to bypass mandatory multi-factor authentication and gain unauthorized access to the Keycloak Admin REST API.
authentification
A flaw was found in the X.509 client certificate authenticator of Keycloak
CVE-2026-103884
6.5 - Medium
- October 01, 2026
A flaw was found in the X.509 client certificate authenticator of Keycloak. When CRL Distribution Point checking is enabled, the server fails to properly validate the file paths provided in a client certificate. An attacker can provide a specially crafted certificate that causes the server to attempt to read sensitive files from the local system or exhaust memory by loading extremely large files, potentially leading to information disclosure or a system crash.
Directory traversal
A flaw was found in the Micrometer user-event metrics listener of Keycloak, a solution for integrated identity and access management
CVE-2026-101333
3.7 - Low
- September 28, 2026
A flaw was found in the Micrometer user-event metrics listener of Keycloak, a solution for integrated identity and access management. The issue occurs when the listener is configured to include the idp tag. An unauthenticated attacker can send requests to the identity broker login endpoint using arbitrary provider aliases, causing the system to create an unlimited number of metric time series. This can lead to excessive memory consumption and degrade the performance of both the server and its monitoring tools.
Allocation of Resources Without Limits or Throttling
Keycloak FGAP v2 PrivEsc via Composite Role Leak
CVE-2026-96448
6.6 - Medium
- September 25, 2026
A flaw was found in the Fine-Grained Admin Permissions (FGAP v2) feature of Keycloak, an identity and access management solution. The issue occurs when the system checks if a delegated administrator has permission to assign a specific role to a user. Because the check does not look inside composite roles to see what other permissions they contain, an administrator with limited rights can assign a role that secretly includes full administrative control. This allows the attacker to gain complete management access over the entire realm.
AuthZ
Keycloak STX v2 Bypass mTLS HoK Binding for Token Use
CVE-2026-97846
6.8 - Medium
- September 25, 2026
Keycloak provides a feature called mTLS holder-of-key binding which ensures that a token can only be used by the client that originally requested it by binding it to their digital certificate. A flaw was discovered where the new Standard Token Exchange V2 feature does not check for this certificate. This allows an attacker with stolen client credentials to obtain a standard, unrestricted token that bypasses these security protections.
authentification
Keycloak Admin REST API Bypass Group Visibility Permissions
CVE-2026-97311
4.3 - Medium
- September 24, 2026
A flaw was found in the Admin REST API of Keycloak, an identity and access management solution. The endpoints used to retrieve groups associated with a specific role do not properly check for individual group visibility permissions. This allows a delegated administrator with basic search privileges to view detailed information about all groups assigned to a role, bypassing intended security restrictions that should limit their view to specific groups.
AuthZ
Keycloak Admin REST API Password Reset Bypass via User Update
CVE-2026-97177
6.6 - Medium
- September 24, 2026
A flaw was found in the user update mechanism of the Keycloak Admin REST API. When Fine-Grained Admin Permissions are enabled, the system fails to check for specific password reset authorizations during a general user profile update. This allows a delegated administrator, who should be restricted from resetting passwords, to change a user's credentials and take over their account.
AuthZ
Keycloak Auth Level Enforcement Bypass
CVE-2026-97176
4.2 - Medium
- September 24, 2026
A flaw was found in the Level of Authentication enforcement mechanism of Keycloak, an identity and access management solution. The issue occurs when a client specifically requires a higher security level for a user who already has an active session at a lower level. Due to a logic error in how session re-evaluations are handled, Keycloak may incorrectly issue a token at the lower security level instead of enforcing the required higher level, potentially allowing unauthorized access to sensitive resources that rely on these security claims.
AuthZ
Keycloak Conditional OTP Auth Bypass via Untrusted Header (CVE-2026-96445)
CVE-2026-96445
6.8 - Medium
- September 23, 2026
A flaw was found in the Conditional OTP authenticator of Keycloak, an identity and access management solution. The issue occurs when the system evaluates specific HTTP headers to determine if a one-time password (OTP) should be skipped, but fails to verify if those headers came from a trusted source. This could allow an attacker who already has a user's password to bypass the second-factor authentication by providing a specially crafted header in their request.
authentification
Keycloak PAR Prompt=none Bypass Enables Multiple Auth Codes
CVE-2026-96446
4.2 - Medium
- September 23, 2026
A flaw was found in the Pushed Authorization Request PAR implementation of Keycloak. The issue occurs when the silent authentication path prompt=none is used, which allows the authorization process to skip certain steps if a user is already logged in. Due to this bypass, the security rule that ensures a pushed request URI is used only once is not enforced. An attacker could potentially reuse a request URI to obtain multiple authorization codes for a user who is already signed in, violating security standards like FAPI-2.
AuthZ
KDC Spoofing in Keycloak Kerberos Federation (Authentication Bypass)
CVE-2026-95503
6.8 - Medium
- September 22, 2026
A flaw was found in the Kerberos federation provider of Keycloak, an open-source identity and access management solution. When Kerberos password authentication is used without SPNEGO, the system fails to verify the identity of the Key Distribution Center (KDC) by requesting a server ticket. This allows an attacker on the same network to spoof the KDC and bypass the authentication process, potentially gaining unauthorized access to user accounts.
Improper Verification of Cryptographic Signature
Stay on top of Security Vulnerabilities
Want an email whenever new vulnerabilities are published for Red Hat Build Keycloak or by Red Hat? Click the Watch button to subscribe.
