Summary
Ein Angreifer kann mehrere Schwachstellen in Keycloak ausnutzen, um seine Privilegien zu erhöhen, um Informationen offenzulegen, um Sicherheitsvorkehrungen zu umgehen und um einen Denial of Service Angriff durchzuführen.
Product
Keycloak ermöglicht Single Sign-On mit Identity and Access Management für moderne Anwendungen und Dienste.
Vulnerabilities 12
-
High 7.3
Keycloak: keycloak: privilege escalation via improper scope mapping enforcement
A flaw was found in Keycloak's Fine-Grained Admin Permissions (FGAPv2) feature. An administrator with limited client management permissions can exploit this vulnerability to assign any realm role, including highly privileged roles, to a client's scope mapping…
-
Medium 6.8
Keycloak: keycloak: privilege escalation due to oversized subject_token jwt
A flaw was found in Keycloak. An authenticated user with low privileges can exploit this vulnerability by sending an oversized subject_token JSON Web Token (JWT) to the TokenEndpoint. When the token exceeds a 4000-character limit, it is silently dropped, caus…
-
Medium 6.8
Keycloak: keycloak: unauthorized account access via replayed refresh tokens after cluster restart
A flaw was found in Keycloak. When revokeRefreshToken=true is enabled and persistent session storage is in use, a server restart can reset internal timing mechanisms. This allows a remote attacker, who has previously captured a user's refresh token, to replay…
-
Medium 6.5
Keycloak: keycloak: security restriction bypass allows unauthorized ropc token acquisition
A flaw was found in Keycloak's Client Policies, specifically within the `org.keycloak.protocol.oidc` component. When certain condition providers (client-type, client-roles, client-attributes, client-scopes) are used to enforce security restrictions, the `reje…
-
Medium 6.5
Keycloak: keycloak: privilege escalation via time-of-check to time-of-use (toctou) vulnerability
A flaw was found in Keycloak. An authenticated administrator with the `manage-clients` role can exploit a Time-of-check to time-of-use (TOCTOU) vulnerability in the name-based admin role checks. This allows the attacker to escalate their privileges to `realm-…
-
Medium 5.9
Keycloak: keycloak: security policy bypass in jwe-encrypted request object processing
A flaw was found in Keycloak. When a JSON Web Encryption (JWE) encrypted request object is submitted, Keycloak may incorrectly process unsigned claims if the decrypted content is raw JSON, bypassing the configured signature policy. This allows a remote attack…
-
Medium 5.3CVE-2026-9794 Public exploit
Keycloak: keycloak: information disclosure via saml ecp endpoint
A flaw was found in Keycloak. A remote, unauthenticated attacker can exploit this vulnerability by sending specially crafted SOAP requests to the SAML ECP (Security Assertion Markup Language Enhanced Client or Proxy) endpoint with varying client IDs. By obser…
-
Medium 5.3
Keycloak: keycloak: denial of service via malformed authorization header
A flaw was found in Keycloak's ClientRegistrationAuth component. A remote unauthenticated attacker can exploit this vulnerability by sending a specially crafted POST request with a malformed 'Authorization: Bearer' header to any client registration endpoint. …
-
Medium 4.9
Keycloak: keycloak: denial of service via malformed ldap password policy response
A flaw was found in Keycloak. A remote attacker with high privileges, such as a realm administrator configuring a malicious Lightweight Directory Access Protocol (LDAP) server or an attacker compromising an upstream LDAP server, could exploit this vulnerabili…
-
Medium 4.3
Keycloak-rhel9: organization data leak after feature disabled in keycloak
A flaw was found in Keycloak. An authenticated user with existing organization membership can exploit this flaw by accessing user-facing APIs, such as the account API or by requesting an OpenID Connect (OIDC) token with the 'organization' scope. This allows o…
-
Medium 4.3
Keycloak: keycloak: brute-force protection bypass in ciba flow
A flaw was found in Keycloak, an open-source identity and access management solution. When a user account is temporarily locked due to repeated failed login attempts, an attacker with valid client credentials can exploit the Client-Initiated Backchannel Authe…
-
Medium 4.2
Keycloak: org.keycloak.protocol.oidc: http parameter pollution in oidc redirect uri allows response parameter duplication - #ghi-604
A flaw was found in Keycloak, an open-source identity and access management solution. When a client application is configured to accept broad redirect Uniform Resource Identifiers (URIs), a remote attacker can manipulate the authentication process by crafting…
Revision history
-
#9
Neue Updates von Red Hat aufgenommen
-
#8
Neue Updates aufgenommen
-
#7
Neue Updates von Red Hat aufgenommen
-
#6
Neue Updates von Red Hat aufgenommen
-
#5
Neue Updates aufgenommen
-
#4
Neue Updates von Red Hat aufgenommen
-
#3
Neue Updates von Red Hat aufgenommen
-
#2
Neue Updates aufgenommen
-
#1
Initiale Fassung
References
-
Red Hat Bugtracker 2481845 vom 2026-05-27
https://bugzilla.redhat.com/show_bug.cgi?id=2481845
-
Red Hat Customer Portal vom 2026-05-27
https://access.redhat.com/security/cve/cve-2026-9689
-
Red Hat Bugtracker 2481877 vom 2026-05-27
https://bugzilla.redhat.com/show_bug.cgi?id=2481877
-
Red Hat Bugtracker 2482458 vom 2026-05-27
https://bugzilla.redhat.com/show_bug.cgi?id=2482458
-
Red Hat Bugtracker 2482459 vom 2026-05-27
https://bugzilla.redhat.com/show_bug.cgi?id=2482459
-
Red Hat Bugtracker 2482460 vom 2026-05-27
https://bugzilla.redhat.com/show_bug.cgi?id=2482460
-
Red Hat Bugtracker 2482461 vom 2026-05-27
https://bugzilla.redhat.com/show_bug.cgi?id=2482461
-
Red Hat Bugtracker 2482462 vom 2026-05-27
https://bugzilla.redhat.com/show_bug.cgi?id=2482462
-
Red Hat Bugtracker 2482464 vom 2026-05-27
https://bugzilla.redhat.com/show_bug.cgi?id=2482464
-
Red Hat Bugtracker 2482470 vom 2026-05-27
https://bugzilla.redhat.com/show_bug.cgi?id=2482470
-
Red Hat Bugtracker 2482473 vom 2026-05-27
https://bugzilla.redhat.com/show_bug.cgi?id=2482473
-
Red Hat Bugtracker 2482467 vom 2026-05-27
https://bugzilla.redhat.com/show_bug.cgi?id=2482467
-
Red Hat Bugtracker 2482465 vom 2026-05-27
https://bugzilla.redhat.com/show_bug.cgi?id=2482465
-
Keycloak 26.6.3 release vom 2026-06-04
https://www.keycloak.org/2026/06/keycloak-2663-released
-
Red Hat Security Advisory RHSA-2026:25098 vom 2026-06-10
https://access.redhat.com/errata/RHSA-2026:25098
-
Red Hat Security Advisory RHSA-2026:25097 vom 2026-06-10
https://access.redhat.com/errata/RHSA-2026:25097
-
Red Hat Security Advisory RHSA-2026:30084 vom 2026-06-25
https://access.redhat.com/errata/RHSA-2026:30084
-
Red Hat Security Advisory RHSA-2026:30049 vom 2026-06-25
https://access.redhat.com/errata/RHSA-2026:30049
-
Red Hat Security Advisory RHSA-2026:30050 vom 2026-06-25
https://access.redhat.com/errata/RHSA-2026:30050
-
Red Hat Security Advisory RHSA-2026:30083 vom 2026-06-25
https://access.redhat.com/errata/RHSA-2026:30083
-
Keycloak 26.7.0 release vom 2026-07-09
https://www.keycloak.org/2026/07/keycloak-2670-released
-
Red Hat Security Advisory RHSA-2026:50848 vom 2026-08-05
https://access.redhat.com/errata/RHSA-2026:50848
-
Red Hat Security Advisory RHSA-2026:50846 vom 2026-08-05
https://access.redhat.com/errata/RHSA-2026:50846
-
Red Hat Security Advisory RHSA-2026:50849 vom 2026-08-05
https://access.redhat.com/errata/RHSA-2026:50849
-
Red Hat Security Advisory RHSA-2026:50847 vom 2026-08-05
https://access.redhat.com/errata/RHSA-2026:50847
-
Red Hat Security Advisory RHSA-2026:56524 vom 2026-08-18
https://access.redhat.com/errata/RHSA-2026:56524
-
Red Hat Security Advisory RHSA-2026:56523 vom 2026-08-19
https://access.redhat.com/errata/RHSA-2026:56523
-
### vom 2026-08-31
https://www.keycloak.org/2026/08/keycloak-2673-released
-
Red Hat Security Advisory RHSA-2026:95762 vom 2026-11-06
https://access.redhat.com/errata/RHSA-2026:95762