Red Hat has released a security update for Red Hat build of Keycloak 26.6.7 addressing multiple vulnerabilities including information disclosure, privilege escalation, authorization bypasses, remote code execution, and denial of service. These flaws affect authentication, authorization, token handling, and endpoint protections. Users of affected versions prior to 26.6.7 are advised to apply the update to mitigate these risks.
CVE-2026-7571 is a vulnerability in Red Hat build of Keycloak 26.4 where a low-privilege user can bypass a security control designed to disable the implicit flow in OpenID Connect clients. By manipulating client data during a session restart, the attacker can obtain access tokens that should be unavailable. These tokens may also be exposed in server logs, proxy logs, and HTTP Referrer headers, leading to sensitive information disclosure. The vulnerability has a CVSS score of 7.1, indicating high severity. Red Hat has released updated packages (Keycloak 26.4.12) addressing this and other related security issues. Users are advised to apply these updates after backing up their installations.
CVE-2026-4630 is an authorization bypass vulnerability in Red Hat build of Keycloak 26.4. An authenticated client can exploit an Insecure Direct Object Reference (IDOR) in the Authorization Services Protection API endpoint by using another resource server's UUID within the same realm. This allows unauthorized GET, PUT, and DELETE operations on resources, potentially leading to information disclosure and unauthorized data modification or deletion. Red Hat has released Keycloak 26.4.12 to address this issue. Users should update to this fixed version to remediate the vulnerability.
CVE-2026-37981 is a medium severity vulnerability in Red Hat build of Keycloak 26.4 that involves broken access control in the Account Resources user lookup endpoint. It allows a remote authenticated user who owns at least one User-Managed Access (UMA) resource to enumerate and harvest personally identifiable information (PII) of all users in the realm by sending crafted requests with arbitrary usernames or email values. Red Hat has released an updated package, Keycloak 26.4.12, that addresses this vulnerability along with others. Users are advised to back up their installations and apply the update. No known exploits are reported in the wild at this time.
CVE-2026-37978 is a medium severity vulnerability in Red Hat build of Keycloak 26.4 where a low-privilege administrator with the 'view-clients' role can exploit the 'evaluate-scopes' Admin API endpoint by supplying an arbitrary user ID. This flaw allows unauthorized disclosure of personally identifiable information (PII) across user roles within the realm. The vulnerability can be exploited remotely via network access to the Admin API. Red Hat has released security updates in version 26.4.12 addressing this and other vulnerabilities. Users are advised to apply the update after backing up their installations.
A session fixation vulnerability was found in Keycloak's login-actions endpoints. An unauthenticated attacker could exploit this flaw by pre-creating an authentication session and tricking a victim into visiting a maliciously crafted link. By leveraging the /login-actions/restart endpoint—which processes session handles without adequate CSRF protection or cookie ownership validation—an attacker can reset the authentication flow state. This causes Single Sign-On (SSO) to authenticate the victim transparently upon clicking the link, allowing the attacker to hijack the required-action form without needing the victim's credentials. A successful exploit could lead to complete account takeover, including highly privileged administrative accounts.
A flaw was found in Keycloak. A remote, unauthenticated attacker can send a specially crafted XML input to the Security Assertion Markup Language (SAML) endpoint. This malicious input can cause high CPU usage and worker thread starvation, leading to a Denial of Service (DoS) where the server becomes unavailable.
A flaw was found in Keycloak. An authenticated user with the uma_protection role can bypass User-Managed Access (UMA) policy validation. This allows the attacker to include resource identifiers owned by other users in a policy creation request, even if the URL path specifies an attacker-owned resource. Consequently, the attacker gains unauthorized permissions to victim-owned resources, enabling them to obtain a Requesting Party Token (RPT) and access sensitive information or perform unauthorized actions.
A flaw was found in Keycloak. An unauthenticated attacker can exploit this vulnerability by sending a specially crafted POST request with an excessively long scope parameter to the OpenID Connect (OIDC) token endpoint. This leads to high resource consumption and prolonged processing times, ultimately resulting in a Denial of Service (DoS) for the Keycloak server.
A flaw was found in Keycloak. Keycloak's Security Assertion Markup Language (SAML) broker endpoint does not properly validate encrypted assertions when the overall SAML response is not signed. An attacker with a valid signed SAML assertion can exploit this by crafting a malicious SAML response. This allows the attacker to inject an encrypted assertion for an arbitrary principal, leading to unauthorized access and potential information disclosure.
A security flaw in the IdentityBrokerService.performLogin endpoint of Keycloak allows authentication to proceed using an Identity Provider (IdP) even after it has been disabled by an administrator. An attacker who knows the IdP alias can reuse a previously generated login request to bypass the administrative restriction. This undermines access control enforcement and may allow unauthorized authentication through a disabled external provider.
A flaw was found in Keycloak. An administrator with `manage-users` permission can bypass the "Only administrators can view" setting for unmanaged attributes, allowing them to modify these attributes. This improper access control can lead to unauthorized changes to user profiles, even when the system is configured to restrict such modifications.
A flaw was found in Keycloak's SAML brokering functionality. When Keycloak is configured as a client in a Security Assertion Markup Language (SAML) setup, it fails to validate the `NotOnOrAfter` timestamp within the `SubjectConfirmationData`. This allows an attacker to delay the expiration of SAML responses, potentially extending the time a response is considered valid and leading to unexpected session durations or resource consumption.
A flaw was found in Keycloak. This vulnerability allows an unauthenticated remote attacker to cause a denial of service (DoS) by repeatedly initiating TLS 1.2 client-initiated renegotiation requests to exhaust server CPU resources, making the service unavailable.
A moderate severity vulnerability (CVE-2025-13467) affecting Red Hat build of Keycloak 26.4.6 involves deserialization of untrusted data in the LDAP User Federation component. This issue could allow an attacker to exploit unsafe deserialization processes. Red Hat has released updated container images and packages for Keycloak 26.4.6 to address this vulnerability. Users are advised to back up their installations before applying the update.
CVE-2025-11538 is a medium-severity vulnerability in Red Hat's build of Keycloak 26.4 where enabling debug mode causes the Java Debug Wire Protocol (JDWP) port to bind to all network interfaces (0.0.0.0) by default. This exposes the debug port to the local network, allowing attackers on the same network segment to attach a remote debugger and execute arbitrary code within the Keycloak JVM. The vulnerability requires no authentication or user interaction but has a high attack complexity due to network access requirements. Exploitation can lead to full compromise of the Keycloak server's confidentiality and integrity. No known exploits are currently reported in the wild. European organizations using this Keycloak version in network environments where debug mode might be enabled are at risk, especially those with sensitive identity and access management deployments.
A flaw was found in Keycloak. An offline session continues to be valid when the offline_access scope is removed from the client. The refresh token is accepted and you can continue to request new tokens for the session. As it can lead to a situation where an administrator removes the scope, and assumes that offline sessions are no longer available, but they are.
A flaw was found in Keycloak. When an authenticated attacker attempts to merge accounts with another existing account during an identity provider (IdP) login, the attacker will subsequently be prompted to "review profile" information. This vulnerability allows the attacker to modify their email address to match that of a victim's account, triggering a verification email sent to the victim's email address. The attacker's email address is not present in the verification email content, making it a potential phishing opportunity. If the victim clicks the verification link, the attacker can gain access to the victim's account.
A vulnerability was found in Keycloak. This issue may allow a privileged attacker to use a malicious payload as the permission while creating items (Resource and Permissions) from the admin console, leading to a stored cross-site scripting (XSS) attack.