Summary
Ein Angreifer kann mehrere Schwachstellen in Keycloak ausnutzen, um Informationen offenzulegen, Daten zu manipulieren, Sicherheitsvorkehrungen zu umgehen und einen Denial of Service zu verursachen.
Product
Keycloak ermöglicht Single Sign-On mit Identity and Access Management für moderne Anwendungen und Dienste.
Vulnerabilities 9
-
High 8.1
Org.keycloak/keycloak-services: open redirect when using wildcard valid redirect uris in keycloak
A flaw was found in Keycloak's URL validation logic during redirect operations. By crafting a malicious request, an attacker could bypass validation to redirect users to unauthorized URLs, potentially leading to the exposure of sensitive information within th…
-
High 7.5
Keycloak: keycloak: denial of service via specially crafted saml input
A flaw was found in Keycloak. A remote, unauthenticated attacker can send a specially crafted XML input to the Security Assertion Markup Language (SAML) endpoint. This malicious input can cause high CPU usage and worker thread starvation, leading to a Denial …
-
High 7.5
Org.keycloak/keycloak-services: session fixation in oidc login flow that can lead to account takeover
A session fixation vulnerability was found in Keycloak's login-actions endpoints. An unauthenticated attacker could exploit this flaw by pre-creating an authentication session and tricking a victim into visiting a maliciously crafted link. By leveraging the /…
-
High 7.1
Keycloak: keycloak: access token disclosure and implicit flow bypass via forged client data
A flaw was found in Keycloak. A low-privilege user, with knowledge of user credentials and client ID, can bypass a security control intended to disable the implicit flow in OpenID Connect (OIDC) clients. By manipulating client data during a session restart, a…
-
Medium 6.8
Keycloak: org.keycloak.authentication: keycloak: unauthorized account takeover via webauthn token replay
A flaw was found in Keycloak. This authentication vulnerability allows a remote attacker to replay `ExecuteActionsActionToken` tokens within Keycloak's WebAuthn (Web Authentication) flow. By intercepting an execute-actions email link, an attacker can register…
-
Medium 6.8
Keycloak: keycloak: unauthorized resource access and data modification via insecure direct object reference
A flaw was found in Keycloak. An authenticated client could exploit an Insecure Direct Object Reference (IDOR) vulnerability in the Authorization Services Protection API endpoint. By knowing or obtaining a resource's unique identifier (UUID) belonging to anot…
-
Medium 6.5
Keycloak: keycloak: information disclosure via oidc token introspection endpoint audience bypass
A flaw was found in Keycloak. This access control vulnerability in Keycloak's OpenID Connect (OIDC) token introspection endpoint allows a confidential client to bypass audience restrictions. An attacker-controlled client with valid credentials can retrieve se…
-
Medium 4.9
Keycloak: org.keycloak.services: keycloak: information disclosure via evaluate-scopes admin api
A flaw was found in Keycloak. A low-privilege administrator with the 'view-clients' role can exploit this by invoking the 'evaluate-scopes' Admin API endpoints with an arbitrary user ID (userId) parameter. This vulnerability allows for cross-role personally i…
-
Medium 4.3
Keycloak: org.keycloak.authorization: keycloak: information disclosure via broken access control in user lookup endpoint
A flaw was found in Keycloak. A broken access control vulnerability in the Account Resources user lookup endpoint allows a remote authenticated user, who owns at least one User-Managed Access (UMA) resource, to enumerate and harvest personally identifiable in…
Revision history
-
#3
Neue Updates von Red Hat aufgenommen
-
#2
Neue Updates aufgenommen
-
#1
Initiale Fassung
References
-
Keycloak 26.6.2 release vom 2026-05-19
https://www.keycloak.org/2026/05/keycloak-2662-released
-
Red Hat Security Advisory RHSA-2026:19594 vom 2026-05-20
https://access.redhat.com/errata/RHSA-2026:19594
-
Red Hat Security Advisory RHSA-2026:19597 vom 2026-05-20
https://access.redhat.com/errata/RHSA-2026:19597
-
Red Hat Security Advisory RHSA-2026:19596 vom 2026-05-20
https://access.redhat.com/errata/RHSA-2026:19596
-
Red Hat Security Advisory RHSA-2026:19595 vom 2026-05-20
https://access.redhat.com/errata/RHSA-2026:19595
-
Keycloak 26.8.2 Release Notes vom 2026-11-05
https://www.keycloak.org/2026/11/keycloak-2682-released
-
Red Hat Security Advisory RHSA-2026:95762 vom 2026-11-06
https://access.redhat.com/errata/RHSA-2026:95762