Medium WID-SEC-2026-3418 6 CVEs

Keycloak: Mehrere Schwachstellen

Published Sep 16, 2026 · Updated Sep 17, 2026 · Revision 2 · de-DE

Platform: Linux

Summary

Ein Angreifer kann mehrere Schwachstellen in Keycloak ausnutzen, um Sicherheitsvorkehrungen zu umgehen, um seine Privilegien zu erhöhen, um einen Denial of Service Angriff durchzuführen und um Informationen offenzulegen.

Product

Keycloak ermöglicht Single Sign-On mit Identity and Access Management für moderne Anwendungen und Dienste.

Vulnerabilities 6

High 8.1

CVE-2026-74909

Keycloak-services: keycloak-services: incomplete fix for cve-2026-15573 allows policy enforcer bypass via percent-encoded uri segments

Keycloak provides a policy enforcer to protect applications by matching incoming web requests against defined security policies. A flaw was found where the enforcer fails to correctly normalize web addresses that contain special encoded characters, such as th…

Red Hat Red Hat Single Sign-On 7 Red Hat build of Keycloak 26.6 Red Hat build of Keycloak 26.4

Sep 16, 2026
High 7.5

CVE-2026-18212

Keycloak-services: keycloak-services: saml redirect deflate helpers leak native zlib state

A flaw was found in the SAML Redirect Binding implementation of Keycloak, an open-source identity and access management solution. The issue occurs because the custom DEFLATE compression and decompression helpers fail to release native zlib memory after use. A…

Red Hat Red Hat Single Sign-On 7 Red Hat JBoss Enterprise Application Platform Expansion Pack Red Hat build of Keycloak 26.6

Sep 16, 2026
High 7.5

CVE-2026-79651

Keycloak-services: keycloak-services: unauthenticated dos via unbounded locale caching

A flaw was found in the theme localization endpoints of the keycloak-services component, which is the core service responsible for authentication flows and theme management in Keycloak. The issue occurs because the system accepts arbitrary locale tags from un…

Red Hat Red Hat Single Sign-On 7 Red Hat build of Keycloak 26.6 Red Hat build of Keycloak 26.4

Sep 16, 2026
High 7.4

CVE-2026-90997

Keycloak-services: keycloak: replay protection bypass leads to unauthorized access via database driver semantics mismatch

A flaw was found in Keycloak. When deployed in stateless mode with MySQL or MariaDB, a mismatch in row-count semantics between the database driver and Keycloak's application logic allows an attacker to bypass replay protection. This vulnerability enables an a…

Red Hat Keycloak Red Hat Build of Keycloak Keycloak

Sep 17, 2026
High 7.2

CVE-2026-17526

Keycloak-services: keycloak-services: privilege escalation via impersonation role allows takeover of realm administrator accounts

Keycloak is an open-source identity and access management solution. A vulnerability was discovered where a user with the impersonation role can impersonate a realm administrator. This allows the attacker to gain full administrative control over the realm, inc…

Red Hat Red Hat Single Sign-On 7 Red Hat JBoss Enterprise Application Platform Expansion Pack Red Hat build of Keycloak 26.6

Sep 16, 2026
Medium 5.3

CVE-2026-19607 Public exploit

Keycloak-services: keycloak-services: broker-originated username collision causes account lockout

A flaw was found in the first-broker-login flow of the keycloak-services component. This component handles the initial authentication and account linking when a user logs in via an external identity provider. The issue allows an attacker to register a matchin…

Red Hat Red Hat Single Sign-On 7 Red Hat build of Keycloak 26.6 Red Hat build of Keycloak 26.4 Ubuntu

Sep 16, 2026

Revision history

2026-09-17 #2
Referenz(en) aufgenommen: EUVD-2026-82396
2026-09-16 #1
Initiale Fassung

References

Keycloak Release Notes vom 2026-09-16
https://www.keycloak.org/2026/09/keycloak-2674-released
GitHub Security Advisory GHSA-xpwp-2pcm-8xq3 vom 2026-09-16
https://github.com/keycloak/keycloak/security/advisories/GHSA-xpwp-2pcm-8xq3