Skip to content
OpenAdvisories
Medium WID-SEC-2026-3849 3 CVEs

Keycloak: Mehrere Schwachstellen

Published Oct 8, 2026 · Updated Nov 8, 2026 · Revision 3 · de

Vendor: Red Hat Product: Enterprise Linux Platform: Linux

Summary

Ein Angreifer kann mehrere Schwachstellen in Keycloak ausnutzen, um Informationen offenzulegen, um Sicherheitsvorkehrungen zu umgehen, und um einen Cross-Site Scripting Angriff durchzuführen.

Product

Keycloak ermöglicht Single Sign-On mit Identity and Access Management für moderne Anwendungen und Dienste.

Vulnerabilities 3

  • Medium 5.5
    CVE-2026-107889

    Keycloak-services: keycloak-services: stored xss on login page via kcsanitize bypass

    A flaw was found in the login theme rendering component of Keycloak. The issue occurs because the security filter responsible for cleaning user input can be bypassed, allowing a realm administrator to store malicious scripts in display fields. This could resu…

    Red Hat Red Hat Single Sign-On 7 Red Hat build of Keycloak 26.6 Red Hat build of Keycloak 26.6.8
  • Medium 4.9
    CVE-2026-107604

    Keycloak-services: keycloak-services: view-clients role allows retrieval of active client secrets via installation provider endpoints

    A flaw was found in the installation provider and client registration endpoints of the Keycloak identity management service. A realm administrator with only the read-only view-clients role can access the active primary secret of any confidential client, which…

    Red Hat Red Hat Single Sign-On 7 Red Hat Build of Keycloak
  • Medium 4.3
    CVE-2026-107623

    Keycloak-services: keycloak-services: oidc dcr read-modify-write silently disables offline token revocation

    A flaw was found in the OIDC Dynamic Client Registration (DCR) component of Keycloak. A bug in the response serialization causes the backchannel logout offline token revocation setting to be omitted from responses. When a client performs a standard update, th…

    Red Hat Red Hat Single Sign-On 7 Red Hat build of Keycloak 26.6 Red Hat build of Keycloak 26.6.8

Revision history

  1. #3

    Neue Updates von Red Hat aufgenommen

  2. #2

    Neue Updates aufgenommen

  3. #1

    Initiale Fassung

References