Threats Tagged 'cve-2026-4636'

A flaw was found in Keycloak. An authenticated user with the uma_protection role can bypass User-Managed Access (UMA) policy validation. This allows the attacker to include resource identifiers owned by other users in a policy creation request, even if the URL path specifies an attacker-owned resource. Consequently, the attacker gains unauthorized permissions to victim-owned resources, enabling them to obtain a Requesting Party Token (RPT) and access sensitive information or perform unauthorized actions.

Red Hat has released updated images for the Red Hat build of Keycloak 26.4.11 addressing multiple security vulnerabilities. These include improper access control issues, information disclosure, privilege escalation, server-side request forgery (SSRF), denial of service, and token replay vulnerabilities affecting the Keycloak Admin REST API, Operator, and related components. The update aligns with the standalone Keycloak product release and is intended for use within OpenShift Container Platform deployments.

Red Hat has released updated container images for Red Hat build of Keycloak version 26.2.15 addressing multiple security vulnerabilities. These include information disclosure via redirect_uri validation bypass, replay of action tokens, unauthorized access through UMA policy bypass, privilege escalation via forged authorization codes, and denial of service through excessive OpenID Connect scope parameter processing. The update aligns with the standalone Keycloak product release and is intended for use within OpenShift Container Platform deployments.

Red Hat has released an important security advisory for Red Hat build of Keycloak 26.4.11 addressing multiple vulnerabilities including improper access control, information disclosure, privilege escalation, server-side request forgery, denial of service, and token replay issues. These vulnerabilities affect the Admin REST API, UMA 2.0 Protection API, account management endpoints, and other components. The update aims to fix these security issues to protect authentication and single sign-on capabilities provided by Keycloak.

Red Hat has released an important security update for its build of Keycloak, version 26.2.15, addressing multiple vulnerabilities. These include information disclosure via redirect_uri validation bypass, replay of action tokens, UMA policy bypass allowing unauthorized resource access, privilege escalation through forged authorization codes, and denial of service via excessive OpenID Connect scope parameter processing. The update mitigates these issues to enhance authentication and single sign-on security for web and mobile applications.