Summary
Ein lokaler, oder entfernter authentisierter Angreifer kann mehrere Schwachstellen in Keycloak ausnutzen, um Informationen offenzulegen.
Product
Keycloak ermöglicht Single Sign-On mit Identity and Access Management für moderne Anwendungen und Dienste.
Vulnerabilities 2
-
Medium 5.0
Keycloak-services: sensitive headers shown in the http access logs
A flaw was found in Keycloak. When the logging format is configured to a verbose, user-supplied pattern (such as the pre-defined 'long' pattern), sensitive headers including Authorization and Cookie are disclosed to the logs in cleartext. An attacker with rea…
-
Low 3.1
Keycloak: keycloak: information disclosure via authorization bypass in admin api
A flaw was found in Keycloak. An authorization bypass vulnerability in the Keycloak Admin API allows any authenticated user, even those without administrative privileges, to enumerate the organization memberships of other users. This information disclosure oc…
Revision history
-
#4
Neue Updates von Red Hat aufgenommen
-
#3
Neue Updates aufgenommen
-
#2
Referenz(en) aufgenommen: EUVD-2026-11553
-
#1
Initiale Fassung
References
-
Red Hat Bugtracker vom 2026-02-11
https://bugzilla.redhat.com/show_bug.cgi?id=2439081
-
Red Hat Bugtracker vom 2026-02-11
https://bugzilla.redhat.com/show_bug.cgi?id=2402616
-
GitHub Advisory Database vom 2026-02-11
https://github.com/advisories/GHSA-gv3v-2cpp-3pmq
-
GitHub Advisory Database vom 2026-02-11
https://github.com/keycloak/keycloak/releases
-
Keycloak 26.5.6 release notes vom 2026-03-19
https://www.keycloak.org/2026/03/keycloak-2656-released
-
Red Hat Security Advisory RHSA-2026:6477 vom 2026-04-02
https://access.redhat.com/errata/RHSA-2026:6477
-
Red Hat Security Advisory RHSA-2026:6478 vom 2026-04-02
https://access.redhat.com/errata/RHSA-2026:6478