Threats Tagged 'cve-2026-3429'

A flaw was identified in the Account REST API of Keycloak that allows a user authenticated at a lower security level to perform sensitive actions intended only for higher-assurance sessions. Specifically, an attacker who has already obtained a victim’s password can delete the victim’s registered MFA/OTP credential without first proving possession of that factor. The attacker can then register their own MFA device, effectively taking full control of the account. This weakness undermines the intended protection provided by multi-factor authentication.

MediumVulnerabilityUnited StatesGermanyUnited Kingdom+7#cve#cve-2026-3429#gcve

Red Hat has released updated images for the Red Hat build of Keycloak 26.4.11 addressing multiple security vulnerabilities. These include improper access control issues, information disclosure, privilege escalation, server-side request forgery (SSRF), denial of service, and token replay vulnerabilities affecting the Keycloak Admin REST API, Operator, and related components. The update aligns with the standalone Keycloak product release and is intended for use within OpenShift Container Platform deployments.

Red Hat has released an important security advisory for Red Hat build of Keycloak 26.4.11 addressing multiple vulnerabilities including improper access control, information disclosure, privilege escalation, server-side request forgery, denial of service, and token replay issues. These vulnerabilities affect the Admin REST API, UMA 2.0 Protection API, account management endpoints, and other components. The update aims to fix these security issues to protect authentication and single sign-on capabilities provided by Keycloak.