Skip to content
OpenAdvisories
Medium WID-SEC-2026-3484 7 CVEs

Keycloak: Mehrere Schwachstellen

Published Sep 20, 2026 · Updated Nov 8, 2026 · Revision 3 · de

Vendor: Red Hat Product: Enterprise Linux Platform: Linux

Summary

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Keycloak ausnutzen, um seine Privilegien zu erhöhen, um Sicherheitsmechanismen zu umgehen und um Informationen offenzulegen.

Product

Keycloak ermöglicht Single Sign-On mit Identity and Access Management für moderne Anwendungen und Dienste.

Vulnerabilities 7

  • Medium 6.6
    CVE-2026-94000 Public exploit

    Keycloak-services: keycloak-services: delegated admin with manage-users can escalate to realm-admin via group membership

    A flaw was found in the Admin REST API of Keycloak, an open-source identity and access management solution. The issue occurs in the group-membership endpoints where the system fails to check if a group grants administrative privileges before allowing a user t…

    Red Hat Red Hat Single Sign-On 7 Red Hat build of Keycloak 26.6 Red Hat build of Keycloak 26.6.8
  • Medium 6.5
    CVE-2026-94001

    Keycloak-services: keycloak-services: admin credential delete bypasses denied reset-password permission

    A flaw was found in the Admin REST API of Keycloak, an open-source identity and access management solution. The endpoint used for deleting user credentials does not correctly check for fine-grained reset-password permissions. This allows a delegated administr…

    Red Hat Red Hat Single Sign-On 7 Red Hat build of Keycloak 26.6 Red Hat build of Keycloak 26.6.8
  • Medium 5.5
    CVE-2026-94215

    Keycloak-services: keycloak-services: cross-realm client read/write via request-level cache missing realm ownership check

    A flaw was found in the Admin REST API of Keycloak, an open-source identity and access management solution. The issue occurs because the API uses a per-request in-memory cache to resolve clients by their unique identifier without verifying if the client belon…

    Red Hat Red Hat Single Sign-On 7 Red Hat build of Keycloak 26.6.8
  • Medium 4.9
    CVE-2026-94213

    Keycloak-services: keycloak-services: authorization services policy evaluation endpoint leaks user identity

    A flaw was found in the Authorization Services component of Keycloak, an open-source identity and access management solution. The issue occurs in the policy evaluation endpoint, which is used by administrators to test how access policies apply to specific use…

    Red Hat Red Hat Single Sign-On 7 Red Hat build of Keycloak 26.6.8
  • Medium 4.2
    CVE-2026-93999

    Keycloak-services: keycloak-services: token refresh continues issuing tokens for disabled audience clients

    A flaw was found in the OIDC protocol implementation of Keycloak, an open-source identity and access management solution. The issue occurs during the token refresh process when the server restores requested audiences from stored client IDs. Keycloak fails to …

    Red Hat Red Hat Single Sign-On 7 Red Hat build of Keycloak 26.6 Red Hat build of Keycloak 26.6.8
  • Low 3.5
    CVE-2026-94217

    Keycloak-services: keycloak-services: uma scope merge across resource owners via resource name collision

    A flaw was found in the User-Managed Access (UMA) implementation of Keycloak. The issue occurs in the authorization token endpoint when processing permission tickets. If two different users own resources with the same name, the system incorrectly merges the p…

    Red Hat Red Hat Single Sign-On 7 Red Hat build of Keycloak 26.6.8
  • Low 3.1
    CVE-2026-94218

    Keycloak-services: keycloak-services: 2fa setup enforcement bypass via authentication session restart endpoint

    A flaw was found in the authentication session management of Keycloak, an identity and access management solution. The issue occurs when an administrator enforces a stronger authentication flow, such as mandatory two-factor authentication (2FA) setup, through…

    Red Hat Red Hat Single Sign-On 7 Red Hat build of Keycloak 26.6.8

Revision history

  1. #3

    Neue Updates von Red Hat aufgenommen

  2. #2

    Neue Updates von Red Hat aufgenommen

  3. #1

    Initiale Fassung

References