Skip to content
OpenAdvisories
Medium WID-SEC-2026-3727 3 CVEs

Keycloak: Mehrere Schwachstellen

Published Oct 4, 2026 · Updated Oct 4, 2026 · de-DE

Summary

Ein Angreifer kann mehrere Schwachstellen in Keycloak ausnutzen, um Informationen offenzulegen und Sicherheitsmaßnahmen zu umgehen.

Product

Keycloak ermöglicht Single Sign-On mit Identity and Access Management für moderne Anwendungen und Dienste.

Vulnerabilities 3

  • Medium 6.5
    CVE-2026-105306 Public exploit

    Keycloak-services: keycloak-services: token introspection audience bypass via dynamic client registration

    A flaw was found in the Dynamic Client Registration flow of the Keycloak identity and access management server. The issue occurs because the registration process fails to filter security-sensitive client attributes when a new client is created. An attacker wi…

    Red Hat Red Hat Single Sign-On 7 Red Hat Build of Keycloak
  • Medium 5.7
    CVE-2026-105302

    Keycloak-services: keycloak-services: user session note mapper exposes upstream idp access tokens

    A flaw was found in the User Session Note mapper of the Keycloak identity and access management solution. The issue occurs because the mapper does not validate whether a requested session note contains sensitive internal credentials, such as federated access …

    Red Hat Red Hat Single Sign-On 7 Red Hat Build of Keycloak
  • Medium 4.0
    CVE-2026-105301 Rejected

    This candidate was rejected after further investigation determined that it is not a security vulnerability. The client …

Revision history

  1. #1

    Initiale Fassung

References