CVE-2026-4630
published 2026-05-19CVE-2026-4630: A flaw was found in Keycloak. An authenticated client could exploit an Insecure Direct Object Reference (IDOR) vulnerability in the Authorization Services…
PriorityP345medium6.8CVSS 3.1
AVNACHPRLUINSUCHIHAN
EPSS
0.30%
22.3th percentile
A flaw was found in Keycloak. An authenticated client could exploit an Insecure Direct Object Reference (IDOR) vulnerability in the Authorization Services Protection API endpoint. By knowing or obtaining a resource's unique identifier (UUID) belonging to another Resource Server within the same realm, the client could bypass authorization checks. This allows the client to perform unauthorized GET, PUT, and DELETE operations on resources, leading to information disclosure and potential unauthorized modification or deletion of data.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| redhat | build_of_keycloak | >= 26.4 < 26.4.12 | 26.4.12 |
| rhbk | keycloak-rhel9 | — | — |
CVSS provenance
nvdv3.16.8MEDIUMCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
vendor_redhat6.8MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Keycloak Protection API allows authenticated clients to access and modify resources owned by other Resource Servers
ghsa·2026-05-19
CVE-2026-4630 [MEDIUM] CWE-639 Keycloak Protection API allows authenticated clients to access and modify resources owned by other Resource Servers
Keycloak Protection API allows authenticated clients to access and modify resources owned by other Resource Servers
Keycloak's Authorization Services feature exposes a User-Managed Access Protection API that include an Insecure Direct Object Reference (IDOR) vulnerability in the Authorization Services Protection API endpoint. By knowing or obtaining a resource's unique identifier (UUID) belonging to another Resource Server within the same realm, an authenticated client could bypass authorization checks. This allows the client to perform unauthorized GET, PUT, and DELETE operations on resources, leading to information disclosure and potential unauthorized modification or deletion of data.
GHSA
GHSA-c739-f6xw-6pv2: A flaw was found in Keycloak
ghsa_unreviewed·2026-05-19
CVE-2026-4630 [MEDIUM] CWE-639 GHSA-c739-f6xw-6pv2: A flaw was found in Keycloak
A flaw was found in Keycloak. An authenticated client could exploit an Insecure Direct Object Reference (IDOR) vulnerability in the Authorization Services Protection API endpoint. By knowing or obtaining a resource's unique identifier (UUID) belonging to another Resource Server within the same realm, the client could bypass authorization checks. This allows the client to perform unauthorized GET, PUT, and DELETE operations on resources, leading to information disclosure and potential unauthorized modification or deletion of data.
Red Hat
keycloak: Keycloak: Unauthorized resource access and data modification via Insecure Direct Object Reference
vendor_redhat·2026-04-15·CVSS 6.8
CVE-2026-4630 [MEDIUM] CWE-639 keycloak: Keycloak: Unauthorized resource access and data modification via Insecure Direct Object Reference
keycloak: Keycloak: Unauthorized resource access and data modification via Insecure Direct Object Reference
A flaw was found in Keycloak. An authenticated client could exploit an Insecure Direct Object Reference (IDOR) vulnerability in the Authorization Services Protection API endpoint. By knowing or obtaining a resource's unique identifier (UUID) belonging to another Resource Server within the same realm, the client could bypass authorization checks. This allows the client to perform unauthorized GET, PUT, and DELETE operations on resources, leading to information disclosure and potential unauthorized modification or deletion of data.
Mitigation: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria compris
No detection rules found.
No public exploits indexed.
2026-05-19
Published