Redhat Build Of Keycloak vulnerabilities

CVE-2026-7504 [HIGH] CWE-601 CVE-2026-7504: A flaw was found in Keycloak's URL validation logic during redirect operations. By crafting a malici A flaw was found in Keycloak's URL validation logic during redirect operations. By crafting a malicious request, an attacker could bypass validation to redirect users to unauthorized URLs, potentially leading to the exposure of sensitive information within the domain or facilitating further attacks. This vulnerability specifically affects Keycloak clien

CVE-2026-3872 [HIGH] CWE-601 CVE-2026-3872: A flaw was found in Keycloak. This issue allows an attacker, who controls another path on the same w A flaw was found in Keycloak. This issue allows an attacker, who controls another path on the same web server, to bypass the allowed path in redirect Uniform Resource Identifiers (URIs) that use a wildcard. A successful attack may lead to the theft of an access token, resulting in information disclosure.

CVE-2026-37982 [MEDIUM] CWE-294 CVE-2026-37982: A flaw was found in Keycloak. This authentication vulnerability allows a remote attacker to replay ` A flaw was found in Keycloak. This authentication vulnerability allows a remote attacker to replay `ExecuteActionsActionToken` tokens within Keycloak's WebAuthn (Web Authentication) flow. By intercepting an execute-actions email link, an attacker can register their own authenticator to a victim's account. This leads to unauthorized enrollment of a h

CVE-2026-37979 [MEDIUM] CWE-284 CVE-2026-37979: A flaw was found in Keycloak. This access control vulnerability in Keycloak's OpenID Connect (OIDC) A flaw was found in Keycloak. This access control vulnerability in Keycloak's OpenID Connect (OIDC) token introspection endpoint allows a confidential client to bypass audience restrictions. An attacker-controlled client with valid credentials can retrieve sensitive token claims intended for other resource servers, compromising the confidentiality of

CVE-2026-9705 [MEDIUM] CWE-613 CVE-2026-9705: A flaw was found in Keycloak's client registration service. A remote attacker, possessing a previous A flaw was found in Keycloak's client registration service. A remote attacker, possessing a previously issued Registration Access Token (RAT), could exploit this vulnerability to re-enable a client that an administrator had explicitly disabled. This bypasses security controls, allowing the attacker to reset the client's secret and potentially regain p

CVE-2026-7571 [HIGH] CWE-472 CVE-2026-7571: A flaw was found in Keycloak. A low-privilege user, with knowledge of user credentials and client ID A flaw was found in Keycloak. A low-privilege user, with knowledge of user credentials and client ID, can bypass a security control intended to disable the implicit flow in OpenID Connect (OIDC) clients. By manipulating client data during a session restart, an attacker can obtain an access token that should not be available. This vulnerability can also

CVE-2024-4629 [MEDIUM] CWE-837 CVE-2024-4629: A vulnerability was found in Keycloak. This flaw allows attackers to bypass brute force protection b A vulnerability was found in Keycloak. This flaw allows attackers to bypass brute force protection by exploiting the timing of login attempts. By initiating multiple login requests simultaneously, attackers can exceed the configured limits for failed attempts before the system locks them out. This timing loophole enables attackers to make more guesses

CVE-2026-16100 [MEDIUM] CWE-770 CVE-2026-16100: A flaw was found in the user-event metrics recording of Keycloak. When metrics are enabled, the syst A flaw was found in the user-event metrics recording of Keycloak. When metrics are enabled, the system records raw error messages from failed account operations as Prometheus metric labels. Because these error messages can include user-supplied input like nonexistent client IDs, an authenticated user can create a massive number of unique metric entr

CVE-2024-7341 [HIGH] CWE-384 CVE-2024-7341: A session fixation issue was discovered in the SAML adapters provided by Keycloak. The session ID an A session fixation issue was discovered in the SAML adapters provided by Keycloak. The session ID and JSESSIONID cookie are not changed at login time, even when the turnOffChangeSessionIdOnLogin option is configured. This flaw allows an attacker who hijacks the current session before authentication to trigger session fixation.

CVE-2026-14614 [MEDIUM] CWE-639 CVE-2026-14614: A flaw was found in the ClientResource component of Keycloak's admin services when Fine-Grained Admi A flaw was found in the ClientResource component of Keycloak's admin services when Fine-Grained Admin Permissions (FGAP) v2 is enabled. This issue allows a delegated administrator, who should only have limited control over specific clients, to attach or remove hidden client scopes that they are not authorized to see or manage. As a result, an attack

CVE-2026-9083 [MEDIUM] CWE-22 CVE-2026-9083: A flaw was found in Keycloak. A realm administrator with the "manage-realm" role can exploit this vu A flaw was found in Keycloak. A realm administrator with the "manage-realm" role can exploit this vulnerability by submitting an arbitrary filesystem path as a keystore parameter when creating a key provider component. This allows the administrator to probe arbitrary filesystem paths, determining which files exist and are readable by the Keycloak proce

CVE-2026-2575 [MEDIUM] CWE-409 CVE-2026-2575: A flaw was found in Keycloak. An unauthenticated remote attacker can trigger an application level De A flaw was found in Keycloak. An unauthenticated remote attacker can trigger an application level Denial of Service (DoS) by sending a highly compressed SAMLRequest through the SAML Redirect Binding. The server fails to enforce size limits during DEFLATE decompression, leading to an OutOfMemoryError (OOM) and subsequent process termination. This vulne

CVE-2026-16071 [MEDIUM] CWE-90 CVE-2026-16071: A flaw was found in the LDAP storage provider of Keycloak, which is used to federate user identities A flaw was found in the LDAP storage provider of Keycloak, which is used to federate user identities from external directories. The issue occurs when a delegated administrator performs a search using a specific LDAP entry Distinguished Name (DN). Due to missing validation, the system allows lookups for users located outside the configured search boun

CVE-2026-4325 [MEDIUM] CWE-653 CVE-2026-4325: A flaw was found in Keycloak. The SingleUseObjectProvider, a global key-value store, lacks proper ty A flaw was found in Keycloak. The SingleUseObjectProvider, a global key-value store, lacks proper type and namespace isolation. This vulnerability allows an attacker to delete arbitrary single-use entries, which can enable the replay of consumed action tokens, such as password reset links. This could lead to unauthorized access or account compromise.

CVE-2026-37978 [MEDIUM] CWE-639 CVE-2026-37978: A flaw was found in Keycloak. A low-privilege administrator with the 'view-clients' role can exploit A flaw was found in Keycloak. A low-privilege administrator with the 'view-clients' role can exploit this by invoking the 'evaluate-scopes' Admin API endpoints with an arbitrary user ID (userId) parameter. This vulnerability allows for cross-role personally identifiable information (PII) leakage, enabling unauthorized visibility into user identities

CVE-2026-11986 [MEDIUM] CWE-425 CVE-2026-11986: A flaw was found in the admin-ui-ext component of Keycloak, which provides extended administrative u A flaw was found in the admin-ui-ext component of Keycloak, which provides extended administrative user interface capabilities. The issue occurs because certain bulk role-removal endpoints fail to perform granular permission checks when deleting role mappings. This allows a delegated administrator with limited permissions to remove highly privileged

CVE-2026-0871 [MEDIUM] CWE-266 CVE-2026-0871: A flaw was found in Keycloak. An administrator with `manage-users` permission can bypass the "Only a A flaw was found in Keycloak. An administrator with `manage-users` permission can bypass the "Only administrators can view" setting for unmanaged attributes, allowing them to modify these attributes. This improper access control can lead to unauthorized changes to user profiles, even when the system is configured to restrict such modifications.

CVE-2025-3910 [MEDIUM] CWE-287 CVE-2025-3910: A flaw was found in Keycloak. The org.keycloak.authorization package may be vulnerable to circumvent A flaw was found in Keycloak. The org.keycloak.authorization package may be vulnerable to circumventing required actions, allowing users to circumvent requirements such as setting up two-factor authentication.

CVE-2026-9799 [MEDIUM] CWE-639 CVE-2026-9799: A flaw was found in org.keycloak.authorization. An authenticated user with a granted User-Managed Ac A flaw was found in org.keycloak.authorization. An authenticated user with a granted User-Managed Access (UMA) permission ticket for one resource can exploit this by using a specific permission request prefix to bypass per-resource access control. This allows the user to gain unauthorized access to all resources of that type within the same resource s

CVE-2026-37981 [MEDIUM] CWE-1220 CVE-2026-37981: A flaw was found in Keycloak. A broken access control vulnerability in the Account Resources user lo A flaw was found in Keycloak. A broken access control vulnerability in the Account Resources user lookup endpoint allows a remote authenticated user, who owns at least one User-Managed Access (UMA) resource, to enumerate and harvest personally identifiable information (PII) for all realm users. By sending crafted requests with arbitrary usernames o