Medium WID-SEC-2026-0197 3 CVEs

Keycloak: Mehrere Schwachstellen

Published Jan 21, 2026 · Updated Apr 6, 2026 · Revision 4 · de-DE

Vendor: Red Hat Product: Enterprise Linux Platform: Linux

Summary

Ein Angreifer kann mehrere Schwachstellen in Keycloak ausnutzen, um Informationen offenzulegen, und um Sicherheitsvorkehrungen zu umgehen.

Product

Keycloak ermöglicht Single Sign-On mit Identity and Access Management für moderne Anwendungen und Dienste.

Vulnerabilities 3

Medium 6.5

CVE-2025-14559

Org.keycloak/keycloak-services: keycloak keycloak-services: business logic flaw allows unauthorized token issuance for disabled users

A flaw was found in the keycloak-services component of Keycloak. This vulnerability allows the issuance of access and refresh tokens for disabled users, leading to unauthorized use of previously revoked privileges, via a business logic vulnerability in the To…

Red Hat Red Hat build of Keycloak 26.4 Red Hat build of Keycloak 26.4.9 keycloak-26.5 Ubuntu Wolfi Maven

Jan 21, 2026
Low 3.1

CVE-2026-1035

Org.keycloak.protocol.oidc: keycloak refresh token reuse bypass via toctou race condition

A flaw was found in the Keycloak server during refresh token processing, specifically in the TokenManager class responsible for enforcing refresh token reuse policies. When strict refresh token rotation is enabled, the validation and update of refresh token u…

Red Hat Red Hat Single Sign-On 7 Red Hat JBoss Enterprise Application Platform Expansion Pack Red Hat build of Keycloak 26.4 Ubuntu Maven

Jan 21, 2026
Low 2.7

CVE-2025-14083

Keycloak-server: keycloak: improper access control in admin rest api leads to information disclosure

A flaw was found in the Keycloak Admin REST API. This vulnerability allows the exposure of backend schema and rules, potentially leading to targeted attacks or privilege escalation via improper access control.

Red Hat Red Hat build of Keycloak 26.4 Red Hat build of Keycloak 26.4.11 org.keycloak:keycloak-services Maven

Jan 21, 2026

Revision history

2026-04-06 #4
Neue Updates aufgenommen
2026-03-18 #3
Neue Updates aufgenommen
2026-02-09 #2
Neue Updates von Red Hat aufgenommen
2026-01-21 #1
Initiale Fassung

References

GitHub Advisory Database vom 2026-01-21
https://github.com/advisories/GHSA-594w-2fwp-jwrc
GitHub Advisory Database vom 2026-01-21
https://github.com/advisories/GHSA-m2w5-7xhv-w6fh
GitHub Advisory Database vom 2026-01-21
https://github.com/advisories/GHSA-wv3h-x6c4-r867
Red Hat Security Advisory RHSA-2026:2366 vom 2026-02-09
https://access.redhat.com/errata/RHSA-2026:2366
Keycloak 26.5.6 release notes vom 2026-03-19
https://www.keycloak.org/2026/03/keycloak-2656-released
Keycloak 26.5.7 release notes vom 2026-04-02
https://www.keycloak.org/2026/04/keycloak-2657-released
Red Hat Security Advisory RHSA-2026:6477 vom 2026-04-02
https://access.redhat.com/errata/RHSA-2026:6477
Red Hat Security Advisory RHSA-2026:6478 vom 2026-04-02
https://access.redhat.com/errata/RHSA-2026:6478