Threats Tagged 'cve-2026-4325'

A flaw was found in Keycloak. The SingleUseObjectProvider, a global key-value store, lacks proper type and namespace isolation. This vulnerability allows an attacker to delete arbitrary single-use entries, which can enable the replay of consumed action tokens, such as password reset links. This could lead to unauthorized access or account compromise.

Red Hat has released updated images for the Red Hat build of Keycloak 26.4.11 addressing multiple security vulnerabilities. These include improper access control issues, information disclosure, privilege escalation, server-side request forgery (SSRF), denial of service, and token replay vulnerabilities affecting the Keycloak Admin REST API, Operator, and related components. The update aligns with the standalone Keycloak product release and is intended for use within OpenShift Container Platform deployments.

Red Hat has released updated container images for Red Hat build of Keycloak version 26.2.15 addressing multiple security vulnerabilities. These include information disclosure via redirect_uri validation bypass, replay of action tokens, unauthorized access through UMA policy bypass, privilege escalation via forged authorization codes, and denial of service through excessive OpenID Connect scope parameter processing. The update aligns with the standalone Keycloak product release and is intended for use within OpenShift Container Platform deployments.

Red Hat has released an important security advisory for Red Hat build of Keycloak 26.4.11 addressing multiple vulnerabilities including improper access control, information disclosure, privilege escalation, server-side request forgery, denial of service, and token replay issues. These vulnerabilities affect the Admin REST API, UMA 2.0 Protection API, account management endpoints, and other components. The update aims to fix these security issues to protect authentication and single sign-on capabilities provided by Keycloak.

Red Hat has released an important security update for its build of Keycloak, version 26.2.15, addressing multiple vulnerabilities. These include information disclosure via redirect_uri validation bypass, replay of action tokens, UMA policy bypass allowing unauthorized resource access, privilege escalation through forged authorization codes, and denial of service via excessive OpenID Connect scope parameter processing. The update mitigates these issues to enhance authentication and single sign-on security for web and mobile applications.