Summary
Ein Angreifer kann mehrere Schwachstellen in Keycloak ausnutzen, um seine Privilegien zu erhöhen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren und sensible Informationen offenzulegen.
Product
Keycloak ermöglicht Single Sign-On mit Identity and Access Management für moderne Anwendungen und Dienste.
Vulnerabilities 15
-
Medium 6.8
Keycloak-services: keycloak-services: google external access-token exchange bypasses hosted-domain restriction
Keycloak allows users to log in using Google accounts and can be configured to only allow users from specific Google Workspace domains. A flaw was found where the token exchange feature, which allows swapping a Google token for a Keycloak token, does not chec…
-
Medium 6.8
Keycloak-services: keycloak-services: microsoft external access-token exchange bypasses configured tenant
Keycloak provides a way to let users log in using Microsoft accounts while restricting access to a specific organization (tenant). A flaw was discovered where this restriction is ignored when using the token exchange feature. This means an attacker with a val…
-
Medium 6.6
Keycloak-services: keycloak-services: fgap v2 group assignment bypass during user creation
A flaw was found in the user creation component of Keycloak when Fine-Grained Admin Permissions V2 (FGAP V2) is enabled. This issue allows a sub-administrator with permission to create users to add those users to any group, even groups the sub-administrator i…
-
Medium 6.5
Keycloak-services: keycloak-services: group policy extendchildren matches sibling group path prefixes
A flaw was found in the group policy evaluation logic of Keycloak, an identity and access management solution. When a group policy is set to extend permissions to child groups, the system incorrectly uses a simple text-based prefix check to verify group membe…
-
Medium 6.5
Keycloak-services: keycloak-services: inactive out-of-audience token introspection leaks signed jwt claim
A flaw was found in the OIDC token introspection endpoint of the keycloak-services component. Keycloak is an open-source identity and access management solution used to secure modern applications and services. The issue occurs when a confidential client, conf…
-
Medium 6.5
Keycloak-services: keycloak-services: uma claim token can override authorization time-policy evaluation attributes
Keycloak provides authorization services that allow administrators to restrict access to resources based on time policies (for example, only allowing access during business hours). A flaw was discovered where a user can include a fake time value in their auth…
-
Medium 6.5
Keycloak-services: keycloak-services: client access-type policy condition bypass during client update
A flaw was found in the keycloak-services component of Keycloak, which is used for managing authentication and authorization flows. The issue occurs when a realm administrator configures client policies to enforce specific authentication requirements on confi…
-
Medium 5.4
Keycloak-services: keycloak-services: full-scope-disabled client policy validation bypass via omitted fullscopeallowed
A flaw was found in the full-scope-disabled client-policy executor within the keycloak-services component. This component is responsible for enforcing security policies during client registration and configuration in Red Hat Build of Keycloak. The issue occur…
-
Medium 4.9
Keycloak-services: keycloak-services: missing per-role authorization on rolecontainerresource composite endpoints
A flaw was found in the RoleContainerResource component of Keycloak. The issue occurs because certain name-based endpoints in the admin REST API do not properly enforce authorization checks when managing composite roles. This allows a delegated administrator …
-
Medium 4.8
core-geonetwork has an Open Redirect Bypass
GeoNetwork is a catalog application to manage spatially referenced resources. From 3.12.0 until 4.2.16 and 4.4.11, unsafe redirect validation in GeonetworkOAuth2LoginAuthenticationFilter and KeycloakAuthenticationProcessingFilter permits an attacker-controlle…
-
Medium 4.2
Keycloak-services: keycloak-services: secure-client-uris policy bypass via localhost-prefixed domains
A flaw was found in the secure-client-uris client policy executor within Keycloak core services. This component is responsible for enforcing security requirements on client configurations, such as requiring encrypted connections for redirect URIs. Due to an i…
-
Medium 4.2
Keycloak-services: keycloak-services: client not-before revocation ignored when realm not-before is older but nonzero
A flaw was found in the TokenManager component of the Keycloak identity management service. When an administrator attempts to revoke tokens for a specific application (client) using a "not-before" policy, the revocation may be silently ignored if the overall …
-
Low 3.7
Keycloak-services: keycloak-services: client policy source-host wildcard domain matching bypass
A flaw was found in the keycloak-services component of Keycloak, which provides identity and access management services. The issue occurs when a realm administrator uses a wildcard domain (like *.example.com) to restrict which hosts can register or update cli…
-
Low 3.4
Keycloak-services: keycloak-services: oidc redirect_uri fragment bypass in http parameter pollution check
A flaw was found in the keycloak-services component of Keycloak, which handles OpenID Connect (OIDC) authentication flows. The issue occurs because the security check designed to prevent HTTP parameter pollution only inspects the query portion of a redirect U…
-
Low 3.4
Keycloak-services: keycloak-services: saml http-redirect binding response preserves query string leading to parameter pollution
A flaw was found in the SAML protocol implementation of Keycloak, an open-source identity and access management solution. The issue occurs when Keycloak handles SAML authentication requests using the HTTP-Redirect binding. If a client is configured with a wil…
Revision history
-
#5
Neue Updates von Red Hat aufgenommen
-
#4
Neue Updates von Red Hat aufgenommen
-
#3
Neue Updates von Red Hat aufgenommen
-
#2
Neue Updates aufgenommen
-
#1
Initiale Fassung
References
-
GitHub Advisory Database vom 2026-08-02
https://github.com/advisories/GHSA-2w88-g477-cxmj
-
GitHub Advisory Database vom 2026-08-02
https://github.com/advisories/GHSA-82v3-6227-jc8x
-
GitHub Advisory Database vom 2026-08-02
https://github.com/advisories/GHSA-c8xx-fr3x-6m5w
-
GitHub Advisory Database vom 2026-08-02
https://github.com/advisories/GHSA-jg59-c35g-76r8
-
GitHub Advisory Database vom 2026-08-02
https://github.com/advisories/GHSA-v8h5-7wp9-qxxv
-
GitHub Advisory Database vom 2026-08-02
https://github.com/advisories/GHSA-vhxw-j6h3-48jm
-
GitHub Advisory Database vom 2026-08-02
https://github.com/advisories/GHSA-w32v-46r7-99r7
-
GitHub Advisory Database vom 2026-08-02
https://github.com/advisories/GHSA-wmhp-w67v-6jm5
-
GitHub Advisory Database vom 2026-08-02
https://github.com/advisories/GHSA-wx5m-whr8-48h5
-
GitHub Advisory Database vom 2026-08-02
https://github.com/advisories/GHSA-r6f5-hj4x-7mq7
-
GitHub Advisory Database vom 2026-08-02
https://github.com/advisories/GHSA-wm3j-jpqg-fwv2
-
GitHub Advisory Database vom 2026-08-02
https://github.com/advisories/GHSA-5vmc-qhfj-qxc3
-
GitHub Advisory Database vom 2026-08-02
https://github.com/advisories/GHSA-mcjq-c4g7-wcfh
-
GitHub Advisory Database vom 2026-08-02
https://github.com/advisories/GHSA-pjp7-q6wp-97qx
-
### vom 2026-08-31
https://www.keycloak.org/2026/08/keycloak-2673-released
-
Red Hat Security Advisory RHSA-2026:68277 vom 2026-09-16
https://access.redhat.com/errata/RHSA-2026:68277
-
Red Hat Security Advisory RHSA-2026:68278 vom 2026-09-16
https://access.redhat.com/errata/RHSA-2026:68278
-
Red Hat Security Advisory RHSA-2026:95759 vom 2026-11-06
https://access.redhat.com/errata/RHSA-2026:95759
-
Red Hat Security Advisory RHSA-2026:95760 vom 2026-11-06
https://access.redhat.com/errata/RHSA-2026:95760
-
Red Hat Security Advisory RHSA-2026:95761 vom 2026-11-06
https://access.redhat.com/errata/RHSA-2026:95761
-
Red Hat Security Advisory RHSA-2026:95762 vom 2026-11-06
https://access.redhat.com/errata/RHSA-2026:95762