Redhat Build Of Keycloak vulnerabilities

CVE-2026-16442 [CRITICAL] CWE-346 CVE-2026-16442: A flaw was found in the SAML broker component of Keycloak, which is used to manage identity federati A flaw was found in the SAML broker component of Keycloak, which is used to manage identity federation and user authentication. The issue occurs because the IdP-initiated Single Sign-On endpoint fails to check if a provider is restricted to account linking only. This allows an attacker with control over a linked upstream identity to bypass login r

CVE-2026-16443 [CRITICAL] CWE-347 CVE-2026-16443: A flaw was found in the SAML metadata import functionality of the keycloak-services component, which A flaw was found in the SAML metadata import functionality of the keycloak-services component, which is the core engine for identity brokering in Red Hat Build of Keycloak. When importing identity provider metadata that lacks specific usage attributes for keys, the system incorrectly disables signature validation for SAML responses even if a signi

CVE-2026-3047 [HIGH] CWE-305 CVE-2026-3047: A flaw was found in org.keycloak.broker.saml. When a disabled Security Assertion Markup Language (SA A flaw was found in org.keycloak.broker.saml. When a disabled Security Assertion Markup Language (SAML) client is configured as an Identity Provider (IdP)-initiated broker landing target, it can still complete the login process and establish a Single Sign-On (SSO) session. This allows a remote attacker to gain unauthorized access to other enabled client

CVE-2026-15572 [HIGH] CWE-843 CVE-2026-15572: A flaw was found in Keycloak's Dynamic Client Registration (DCR) security policy management. The "Al A flaw was found in Keycloak's Dynamic Client Registration (DCR) security policy management. The "Allowed Protocol Mapper Types" policy, which restricts which types of data mappers a client can use, fails to re-validate the mapper type during a client update if the mapper's configuration remains unchanged. An attacker with client registration privileg

CVE-2026-9800 [HIGH] CWE-1025 CVE-2026-9800: A flaw was found in Keycloak Policy Enforcer. This vulnerability allows any authenticated user to by A flaw was found in Keycloak Policy Enforcer. This vulnerability allows any authenticated user to bypass all authorization policies, including role, scope, and User-Managed Access (UMA) permission checks. By including the configured access-denied page path within a request URL, either as a path segment or a query parameter, an attacker can gain unautho

CVE-2026-1609 [HIGH] CWE-284 CVE-2026-1609: A flaw was found in Keycloak. When the JSON Web Token (JWT) authorization grant preview feature is e A flaw was found in Keycloak. When the JSON Web Token (JWT) authorization grant preview feature is enabled and a user account is disabled, Keycloak fails to validate the user’s disabled status during JWT authorization grant processing. A remote attacker with low privileges can exploit this improper access control vulnerability by presenting a valid asse

CVE-2026-16102 [HIGH] CWE-551 CVE-2026-16102: A flaw was found in the Dynamic Client Registration (DCR) component of Keycloak, an identity and acc A flaw was found in the Dynamic Client Registration (DCR) component of Keycloak, an identity and access management solution. The default DCR policy fails to properly validate the claim path for User Property mappers, allowing them to write values to sensitive internal claim locations. An attacker with a standard user account and a limited Initial Acce

CVE-2026-2603 [HIGH] CWE-306 CVE-2026-2603: A flaw was found in Keycloak. A remote attacker could bypass security controls by sending a valid SA A flaw was found in Keycloak. A remote attacker could bypass security controls by sending a valid SAML response from an external Identity Provider (IdP) to the Keycloak SAML endpoint for IdP-initiated broker logins. This allows the attacker to complete broker logins even when the SAML Identity Provider is disabled, leading to unauthorized authentication

CVE-2026-15573 [HIGH] CWE-551 CVE-2026-15573: A flaw was found in Keycloak's Authorization Services. The component responsible for matching reques A flaw was found in Keycloak's Authorization Services. The component responsible for matching request paths to security policies (PathMatcher) does not properly normalize URIs before comparison. By adding extra characters like a trailing slash or matrix parameters to a URL, an attacker can trick the system into applying a less restrictive security pol

CVE-2026-11800 [HIGH] CWE-347 CVE-2026-11800: A flaw was found in Keycloak. This JWT algorithm confusion vulnerability in the JWT Authorization Gr A flaw was found in Keycloak. This JWT algorithm confusion vulnerability in the JWT Authorization Grant flow allows an attacker with valid client credentials to bypass signature verification. By forging an assertion, the attacker can create unauthorized access tokens. This enables the attacker to impersonate any federated user linked to the affected I

CVE-2026-4282 [HIGH] CWE-653 CVE-2026-4282: A flaw was found in Keycloak. The SingleUseObjectProvider, a global key-value store, lacks proper ty A flaw was found in Keycloak. The SingleUseObjectProvider, a global key-value store, lacks proper type and namespace isolation. This vulnerability allows an unauthenticated attacker to forge authorization codes. Successful exploitation can lead to the creation of admin-capable access tokens, resulting in privilege escalation.

CVE-2026-3009 [HIGH] CWE-863 CVE-2026-3009: A security flaw in the IdentityBrokerService.performLogin endpoint of Keycloak allows authentication A security flaw in the IdentityBrokerService.performLogin endpoint of Keycloak allows authentication to proceed using an Identity Provider (IdP) even after it has been disabled by an administrator. An attacker who knows the IdP alias can reuse a previously generated login request to bypass the administrative restriction. This undermines access control e

CVE-2026-9099 [HIGH] CWE-639 CVE-2026-9099: A flaw was found in Keycloak. A missing authorization check in the GroupResource.addChild() endpoint A flaw was found in Keycloak. A missing authorization check in the GroupResource.addChild() endpoint within the Admin REST API allows an authenticated user with limited administrative privileges to reparent any existing group. When Fine-Grained Admin Permissions v2 (FGAPv2) is enabled, an attacker with management rights over a single low-privilege group

CVE-2026-2092 [HIGH] CWE-1287 CVE-2026-2092: A flaw was found in Keycloak. Keycloak's Security Assertion Markup Language (SAML) broker endpoint d A flaw was found in Keycloak. Keycloak's Security Assertion Markup Language (SAML) broker endpoint does not properly validate encrypted assertions when the overall SAML response is not signed. An attacker with a valid signed SAML assertion can exploit this by crafting a malicious SAML response. This allows the attacker to inject an encrypted assertion

CVE-2026-7507 [HIGH] CWE-290 CVE-2026-7507: A session fixation vulnerability was found in Keycloak's login-actions endpoints. An unauthenticated A session fixation vulnerability was found in Keycloak's login-actions endpoints. An unauthenticated attacker could exploit this flaw by pre-creating an authentication session and tricking a victim into visiting a maliciously crafted link. By leveraging the /login-actions/restart endpoint—which processes session handles without adequate CSRF protection

CVE-2026-4636 [HIGH] CWE-551 CVE-2026-4636: A flaw was found in Keycloak. An authenticated user with the uma_protection role can bypass User-Man A flaw was found in Keycloak. An authenticated user with the uma_protection role can bypass User-Managed Access (UMA) policy validation. This allows the attacker to include resource identifiers owned by other users in a policy creation request, even if the URL path specifies an attacker-owned resource. Consequently, the attacker gains unauthorized permi

CVE-2026-7307 [HIGH] CWE-1286 CVE-2026-7307: A flaw was found in Keycloak. A remote, unauthenticated attacker can send a specially crafted XML in A flaw was found in Keycloak. A remote, unauthenticated attacker can send a specially crafted XML input to the Security Assertion Markup Language (SAML) endpoint. This malicious input can cause high CPU usage and worker thread starvation, leading to a Denial of Service (DoS) where the server becomes unavailable.

CVE-2026-4634 [HIGH] CWE-1050 CVE-2026-4634: A flaw was found in Keycloak. An unauthenticated attacker can exploit this vulnerability by sending A flaw was found in Keycloak. An unauthenticated attacker can exploit this vulnerability by sending a specially crafted POST request with an excessively long scope parameter to the OpenID Connect (OIDC) token endpoint. This leads to high resource consumption and prolonged processing times, ultimately resulting in a Denial of Service (DoS) for the Keyclo

CVE-2026-9086 [HIGH] CWE-79 CVE-2026-9086: A flaw was found in Keycloak. A remote attacker with administrative privileges, specifically those w A flaw was found in Keycloak. A remote attacker with administrative privileges, specifically those with `manage-client` permission or access to client registration endpoints, could bypass client Uniform Resource Identifier (URI) validation. This is achieved by registering a malicious client with a specially crafted redirect URI using a case-insensitive `

CVE-2026-4630 [MEDIUM] CWE-639 CVE-2026-4630: A flaw was found in Keycloak. An authenticated client could exploit an Insecure Direct Object Refere A flaw was found in Keycloak. An authenticated client could exploit an Insecure Direct Object Reference (IDOR) vulnerability in the Authorization Services Protection API endpoint. By knowing or obtaining a resource's unique identifier (UUID) belonging to another Resource Server within the same realm, the client could bypass authorization checks. This