Threats Tagged 'cve-2026-17048'

Red Hat build of Keycloak is an integrated sign-on solution, available as a Red Hat JBoss Middleware for OpenShift containerized image. The Red Hat build of Keycloak for OpenShift image provides an authentication server that you can use to log in centrally, log out, and register. You can also manage user accounts for web applications, mobile applications, and RESTful web services. Red Hat build of Keycloak Operator for OpenShift simplifies deployment and management of Keycloak 26.6.6 clusters. This erratum releases new images for Red Hat build of Keycloak 26.6.6 for use within the OpenShift Container Platform cloud computing Platform-as-a-Service (PaaS) for on-premise or private cloud deployments, aligning with the standalone product release. Security fixes: * FGAP v2 role groups endpoint discloses hidden group metadata without group view permission (CVE-2026-14613) * Predictable account-linking hash enables account takeover via malicious OIDC client (CVE-2026-15571) * Vault-resolved rotated client secrets leaked via Admin REST API (CVE-2026-17048) * Unauthenticated account takeover via reset-credentials flow bypass (CVE-2026-18963) * Privilege escalation via Time-of-Check to Time-of-Use (TOCTOU) vulnerability (CVE-2026-9796)

Red Hat build of Keycloak 26.6.6 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single sign-on capabilities for web and mobile applications. Security fixes: * FGAP v2 role groups endpoint discloses hidden group metadata without group view permission (CVE-2026-14613) * Predictable account-linking hash enables account takeover via malicious OIDC client (CVE-2026-15571) * Vault-resolved rotated client secrets leaked via Admin REST API (CVE-2026-17048) * Unauthenticated account takeover via reset-credentials flow bypass (CVE-2026-18963) * Privilege escalation via Time-of-Check to Time-of-Use (TOCTOU) vulnerability (CVE-2026-9796)

A flaw was found in the Keycloak Admin REST API, which is used to manage security realms and clients. The issue occurs when the system processes requests for rotated client secrets that are stored in a secure vault. Due to improper boundary enforcement, a delegated administrator with view-only permissions can retrieve the actual resolved secret instead of the vault placeholder, leading to the exposure of sensitive credentials.