Summary
Ein Angreifer kann mehrere Schwachstellen in Keycloak ausnutzen, um Informationen offenzulegen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren oder erweiterte Berechtigungen zu erlangen.
Product
Keycloak ermöglicht Single Sign-On mit Identity and Access Management für moderne Anwendungen und Dienste.
Vulnerabilities 4
-
Medium 5.4
Keycloak-services: keycloak-services: fgap v2 client scope assignment bypass via clientresource
A flaw was found in the ClientResource component of Keycloak's admin services when Fine-Grained Admin Permissions (FGAP) v2 is enabled. This issue allows a delegated administrator, who should only have limited control over specific clients, to attach or remov…
-
Medium 4.8
Keycloak-services: keycloak-services: oidc email_verified claim incorrectly applied to userinfo email
A flaw exists in the org.keycloak.broker.oidc package where the OIDC broker incorrectly synchronizes the email_verified claim. When an OIDC identity provider is configured with trustEmail=true and the userinfo endpoint is enabled, Keycloak retrieves the email…
-
Medium 4.3
Keycloak-services: keycloak-services: keycloak: fgap v2 role groups endpoint discloses hidden group metadata without group view permission
A vulnerability was discovered in Keycloak's administrative interface that allows certain administrators to see information about groups they shouldn't have access to. When the new Fine-Grained Admin Permissions (FGAP v2) are turned on, an administrator who i…
-
Medium 4.3
Keycloak-services: keycloak: fgap v2 parent group children endpoint bypasses per-child view permission filter
A flaw was found in the Fine-Grained Admin Permissions (FGAP) v2 implementation within Keycloak's administrative services. When FGAP v2 is enabled, the system fails to properly filter child groups based on the caller's specific permissions when requested thro…
Revision history
-
#4
Neue Updates aufgenommen
-
#3
Neue Updates aufgenommen
-
#2
Neue Updates von Red Hat aufgenommen
-
#1
Initiale Fassung
References
-
Red Hat Bugtracker 2496878 vom 2026-07-05
https://bugzilla.redhat.com/show_bug.cgi?id=2496878
-
Red Hat Bugtracker 2496889 vom 2026-07-05
https://bugzilla.redhat.com/show_bug.cgi?id=2496889
-
Red Hat Bugtracker 2496891 vom 2026-07-05
https://bugzilla.redhat.com/show_bug.cgi?id=2496891
-
Red Hat Bugtracker 2497118 vom 2026-07-05
https://bugzilla.redhat.com/show_bug.cgi?id=2497118
-
GitHub Security Advisory GHSA-J2VP-W8G9-P6HF vom 2026-07-05
https://github.com/advisories/GHSA-J2VP-W8G9-P6HF
-
GitHub Security Advisory GHSA-P39J-8498-PCJW vom 2026-07-05
https://github.com/advisories/GHSA-P39J-8498-PCJW
-
GitHub Security Advisory GHSA-5qq8-h7qh-phfj vom 2026-07-05
https://github.com/advisories/GHSA-5qq8-h7qh-phfj
-
GitHub Security Advisory GHSA-c96p-56gh-3pvw vom 2026-07-05
https://github.com/advisories/GHSA-c96p-56gh-3pvw
-
Red Hat Security Advisory RHSA-2026:50846 vom 2026-08-05
https://access.redhat.com/errata/RHSA-2026:50846
-
Red Hat Security Advisory RHSA-2026:50848 vom 2026-08-05
https://access.redhat.com/errata/RHSA-2026:50848
-
Red Hat Security Advisory RHSA-2026:50849 vom 2026-08-05
https://access.redhat.com/errata/RHSA-2026:50849
-
Red Hat Security Advisory RHSA-2026:50847 vom 2026-08-05
https://access.redhat.com/errata/RHSA-2026:50847
-
Keycloak 26.7.2 release vom 2026-08-19
https://www.keycloak.org/2026/08/keycloak-2672-released
-
Red Hat Security Advisory RHSA-2026:56524 vom 2026-08-18
https://access.redhat.com/errata/RHSA-2026:56524
-
Red Hat Security Advisory RHSA-2026:56523 vom 2026-08-19
https://access.redhat.com/errata/RHSA-2026:56523
-
Keycloak 26.8.0 released vom 2026-10-01
https://www.keycloak.org/2026/10/keycloak-2680-released