Summary
Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Keycloak ausnutzen, um Sicherheitsvorkehrungen zu umgehen und Daten zu manipulieren.
Product
Keycloak ermöglicht Single Sign-On mit Identity and Access Management für moderne Anwendungen und Dienste.
Vulnerabilities 2
-
Medium 6.5
Keycloak-services: keycloak-services: client policy source-group condition bypass via duplicate group name matching
A flaw was found in the client policy enforcement mechanism of Keycloak. The issue occurs when the system checks group membership by name instead of a unique identifier. An attacker with client management privileges could bypass security policies by joining a…
-
Medium 5.5
Keycloak-services: keycloak-services: generic identity-provider creation can bind brokers to organizations without manage-organizations
Keycloak provides a way to manage identity providers and organizations through its administrative API. A flaw was discovered where an administrator with permission to manage identity providers could link a new provider to an organization without having the re…
Revision history
-
#5
Neue Updates von Red Hat aufgenommen
-
#4
Neue Updates von Red Hat aufgenommen
-
#3
Neue Updates von Red Hat aufgenommen
-
#2
Neue Updates aufgenommen
-
#1
Initiale Fassung
References
-
EU Vulnerability Database vom 2026-07-28
https://euvd.enisa.europa.eu/enisa/EUVD-2026-50214
-
EU Vulnerability Database vom 2026-07-28
https://euvd.enisa.europa.eu/enisa/EUVD-2026-50215
-
### vom 2026-08-31
https://www.keycloak.org/2026/08/keycloak-2673-released
-
Red Hat Security Advisory RHSA-2026:68277 vom 2026-09-16
https://access.redhat.com/errata/RHSA-2026:68277
-
Red Hat Security Advisory RHSA-2026:68278 vom 2026-09-16
https://access.redhat.com/errata/RHSA-2026:68278
-
Red Hat Security Advisory RHSA-2026:95761 vom 2026-11-06
https://access.redhat.com/errata/RHSA-2026:95761
-
Red Hat Security Advisory RHSA-2026:95762 vom 2026-11-06
https://access.redhat.com/errata/RHSA-2026:95762