Keycloak: Mehrere Schwachstellen

Summary

Product

Vulnerabilities 2

• Medium 4.3
  CVE-2026-4628

  Keycloak: org.keycloak.authorization: keycloak: unauthorized resource modification due to improper access control

  A flaw was found in Keycloak. An improper Access Control vulnerability in Keycloak’s User-Managed Access (UMA) resource_set endpoint allows attackers with valid credentials to bypass the allowRemoteResourceManagement=false restriction. This occurs due to inco…

  Red Hat Red Hat Single Sign-On 7 Red Hat JBoss Enterprise Application Platform Expansion Pack Red Hat JBoss Enterprise Application Platform 8 Wolfi Maven
  Mar 23, 2026
• Low 3.7
  CVE-2026-4633

  Keycloak: keycloak: user enumeration via differential error messages

  A flaw was found in Keycloak. A remote attacker can exploit differential error messages during the identity-first login flow when Organizations are enabled. This vulnerability allows an attacker to determine the existence of users, leading to information disc…

  Red Hat Red Hat Build of Keycloak Red Hat build of Keycloak 26.4.12 keycloak-26.5 Wolfi Maven
  Mar 23, 2026

Revision history

1. 2026-09-30 #5

   Neue Updates aufgenommen

2. 2026-05-19 #4

   Neue Updates aufgenommen

3. 2026-03-26 #3

   Referenz(en) aufgenommen: GHSA-RHGQ-F8X5-J2JC

4. 2026-03-23 #2

   Referenz(en) aufgenommen: EUVD-2026-14389, EUVD-2026-14400

5. 2026-03-22 #1

   Initiale Fassung

References

• Red Hat Bugtracker vom 2026-03-22
  https://bugzilla.redhat.com/show_bug.cgi?id=2450240
• Red Hat Bugtracker vom 2026-03-22
  https://bugzilla.redhat.com/show_bug.cgi?id=2450247
• Red Hat Security Advisory vom 2026-03-23
  https://access.redhat.com/security/cve/cve-2026-4628
• Keycloak 26.6.2 release vom 2026-05-19
  https://www.keycloak.org/2026/05/keycloak-2662-released
• Keycloak 26.8.0 released vom 2026-10-01
  https://www.keycloak.org/2026/10/keycloak-2680-released