High WID-SEC-2026-0356 4 CVEs

Keycloak: Mehrere Schwachstellen

Published Feb 9, 2026 · Updated Jul 15, 2026 · Revision 2 · de-DE

Summary

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Keycloak ausnutzen, um seine Privilegien zu erhöhen und Sicherheitsmaßnahmen zu umgehen.

Product

Keycloak ermöglicht Single Sign-On mit Identity and Access Management für moderne Anwendungen und Dienste.

Vulnerabilities 4

High 8.8

CVE-2026-1486

Org.keycloak.protocol.oidc.grants: disabled identity providers are still accepted for jwt authorization grant

A flaw was found in Keycloak. A vulnerability exists in the jwt-authorization-grant flow where the server fails to verify if an Identity Provider (IdP) is enabled before issuing tokens. The issuer lookup mechanism (lookupIdentityProviderFromIssuer) retrieves …

Red Hat Red Hat build of Keycloak 26.4 Red Hat build of Keycloak 26.4.9 org.keycloak:keycloak-services Wolfi Maven

Feb 9, 2026
High 8.1

CVE-2026-1529 Public exploit

Org.keycloak.services.resources.organizations: keycloak: unauthorized organization registration via improper invitation token validation

A flaw was found in Keycloak. An attacker can exploit this vulnerability by modifying the organization ID and target email within a legitimate invitation token's JSON Web Token (JWT) payload. This lack of cryptographic signature verification allows the attack…

Red Hat Red Hat build of Keycloak 26.4 Red Hat build of Keycloak 26.2 Red Hat build of Keycloak 26.4.9 Wolfi Maven

Feb 9, 2026
High 8.1

CVE-2026-1609

Org.keycloak/keycloak-quarkus-server: keycloak: unauthorized access via jwt authorization grant with disabled users

A flaw was found in Keycloak. When the JSON Web Token (JWT) authorization grant preview feature is enabled and a user account is disabled, Keycloak fails to validate the user’s disabled status during JWT authorization grant processing. A remote attacker with …

Red Hat Keycloak Red Hat JBoss Enterprise Application Platform Expansion Pack Red Hat JBoss Enterprise Application Platform 8

Jul 16, 2026
Medium 5.4

CVE-2025-14778

Keycloak: incorrect ownership checks in /uma-policy/

A flaw was found in Keycloak. A significant Broken Access Control vulnerability exists in the UserManagedPermissionService (UMA Protection API). When updating or deleting a UMA policy associated with multiple resources, the authorization check only verifies t…

Red Hat Red Hat build of Keycloak 26.4 Red Hat build of Keycloak 26.2 Red Hat build of Keycloak 26.4.9 Wolfi Maven

Feb 9, 2026

Revision history

2026-07-15 #2
Referenz(en) aufgenommen: EUVD-2026-44841
2026-02-09 #1
Initiale Fassung

References

Keycloak 26.5.3 release notes vom 2026-02-10
https://www.keycloak.org/2026/02/keycloak-2653-released