CVE-2026-4630: Authorization Bypass Through User-Controlled Key in Red Hat Red Hat build of Keycloak 26.4
CVE-2026-4630 is an authorization bypass vulnerability in Red Hat build of Keycloak 26.4. An authenticated client can exploit an Insecure Direct Object Reference (IDOR) in the Authorization Services Protection API endpoint by using another resource server's UUID within the same realm. This allows unauthorized GET, PUT, and DELETE operations on resources, potentially leading to information disclosure and unauthorized data modification or deletion. Red Hat has released Keycloak 26.4.12 to address this issue. Users should update to this fixed version to remediate the vulnerability.
AI Analysis
Technical Summary
CVE-2026-4630 affects Red Hat build of Keycloak 26.4 and involves an authorization bypass via an Insecure Direct Object Reference (IDOR) vulnerability in the Authorization Services Protection API endpoint. Authenticated clients can misuse another resource server's UUID within the same realm to perform unauthorized GET, PUT, and DELETE operations on resources. This vulnerability can lead to unauthorized information disclosure and modification or deletion of data. The vulnerability has a CVSS v3.1 score of 6.8 (medium severity). Red Hat has released version 26.4.12 of Keycloak containing security updates that fix this and other vulnerabilities.
Potential Impact
Exploitation of this vulnerability allows an authenticated client to bypass authorization controls and access or modify resources belonging to other resource servers within the same realm. This can result in unauthorized information disclosure and unauthorized modification or deletion of data. The CVSS score of 6.8 reflects a medium severity impact with high confidentiality and integrity impact but no availability impact.
Mitigation Recommendations
Red Hat has released Keycloak version 26.4.12 which includes security updates addressing CVE-2026-4630. Users are strongly advised to update to version 26.4.12 or later to remediate this vulnerability. Before applying the update, back up existing installations, including applications, configuration files, and databases. No other specific mitigations are indicated by the vendor advisory.
CVE-2026-4630: Authorization Bypass Through User-Controlled Key in Red Hat Red Hat build of Keycloak 26.4
Description
CVE-2026-4630 is an authorization bypass vulnerability in Red Hat build of Keycloak 26.4. An authenticated client can exploit an Insecure Direct Object Reference (IDOR) in the Authorization Services Protection API endpoint by using another resource server's UUID within the same realm. This allows unauthorized GET, PUT, and DELETE operations on resources, potentially leading to information disclosure and unauthorized data modification or deletion. Red Hat has released Keycloak 26.4.12 to address this issue. Users should update to this fixed version to remediate the vulnerability.
CVSS v3.1
Score 6.8medium
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-4630 affects Red Hat build of Keycloak 26.4 and involves an authorization bypass via an Insecure Direct Object Reference (IDOR) vulnerability in the Authorization Services Protection API endpoint. Authenticated clients can misuse another resource server's UUID within the same realm to perform unauthorized GET, PUT, and DELETE operations on resources. This vulnerability can lead to unauthorized information disclosure and modification or deletion of data. The vulnerability has a CVSS v3.1 score of 6.8 (medium severity). Red Hat has released version 26.4.12 of Keycloak containing security updates that fix this and other vulnerabilities.
Potential Impact
Exploitation of this vulnerability allows an authenticated client to bypass authorization controls and access or modify resources belonging to other resource servers within the same realm. This can result in unauthorized information disclosure and unauthorized modification or deletion of data. The CVSS score of 6.8 reflects a medium severity impact with high confidentiality and integrity impact but no availability impact.
Mitigation Recommendations
Red Hat has released Keycloak version 26.4.12 which includes security updates addressing CVE-2026-4630. Users are strongly advised to update to version 26.4.12 or later to remediate this vulnerability. Before applying the update, back up existing installations, including applications, configuration files, and databases. No other specific mitigations are indicated by the vendor advisory.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- redhat
- Date Reserved
- 2026-03-23T08:12:45.479Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
- Vendor Advisory Urls
- [{"url":"https://access.redhat.com/security/cve/CVE-2026-4630","vendor":"Red Hat"}]
Threat ID: 6a0c47d9ec166c07b097b82d
Added to database: 05/19/2026, 11:22:01 UTC
Last enriched: 06/30/2026, 23:44:03 UTC
Last updated: 07/31/2026, 19:22:59 UTC
Views: 106
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.