Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 195

Export CSV
CVE-2026-18963

Keycloak-services: keycloak-services: unauthenticated account takeover via reset-credentials flow bypass

A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak. The issue allows an unauthenticated attacker to force the password reset process for any user without needing to click the required email verification link. This can result in the attacker gaining full control over target user accounts by directly setting new credentials.

CVSS 3.1 · 9.1 Critical EPSS 8.1% KEV · Not listed
Vendors
Redhat
Products
Build Keycloak Build Of Keycloak Jboss Enterprise Application Platform Expansion Pack and 4 more
CVE-2026-89059

Resteasy-core: resteasy: iioimageprovider unbounded image decode (decompression-bomb dos)

A flaw was found in RESTEasy's IIOImageProvider, which decodes attacker-supplied image request bodies without enforcing any limit on the declared image dimensions or pixel count. A remote, unauthenticated attacker can send a small crafted image declaring enormous dimensions to trigger a very large memory allocation, exhausting the JVM heap and resulting in a denial of service.

CVSS 3.1 · 7.5 High EPSS 1.5% KEV · Not listed
Vendors
Redhat
Products
Apache Camel Quarkus Apicurio Registry Build Keycloak and 24 more
CVE-2026-89058

Resteasy-core: resteasy: corsfilter reflects arbitrary origin with credentials under wildcard config

A flaw was found in RESTEasy's CorsFilter, which, when configured to allow all origins ("*"), reflects the request's Origin header back in the Access-Control-Allow-Origin response together with Access-Control-Allow-Credentials: true. This permissive cross-origin policy allows a malicious website to make credentialed cross-origin requests and read authenticated responses from a victim's session, resulting in a loss of confidentiality.

CVSS 3.1 · 7.4 High EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Apache Camel Quarkus Apicurio Registry Build Keycloak and 24 more
CVE-2026-92358

Keycloak-services: keycloak-services: residual cross-browser account-link proof allows silent re-linking

A flaw was found in the first broker login flow of Keycloak. When a user confirms an account-linking request from a different browser, a temporary proof is created to validate the link. However, this proof is not properly cleared after the link is established or when the user later manually removes the link. An attacker who controls the external identity can exploit this leftover proof to silently re-establish the link and gain unauthorized access to the victims account without any further confirmation.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed
Vendors
Red Hat Redhat
Products
Red Hat Build Of Keycloak 26.4 Build Keycloak Build Of Keycloak and 2 more
CVE-2026-94001

Keycloak-services: keycloak-services: admin credential delete bypasses denied reset-password permission

A flaw was found in the Admin REST API of Keycloak, an open-source identity and access management solution. The endpoint used for deleting user credentials does not correctly check for fine-grained reset-password permissions. This allows a delegated administrator, who should be restricted from resetting passwords, to delete a user's password credentials, resulting in the user being unable to log in.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Red Hat Redhat
Products
Red Hat Build Of Keycloak 26.4 Build Keycloak Build Of Keycloak and 2 more
CVE-2026-94213

Keycloak-services: keycloak-services: authorization services policy evaluation endpoint leaks user identity

A flaw was found in the Authorization Services component of Keycloak, an open-source identity and access management solution. The issue occurs in the policy evaluation endpoint, which is used by administrators to test how access policies apply to specific users. Due to missing authorization checks, a delegated administrator with limited viewing privileges can access the full profile and role information of any user in the realm, even if they are not permitted to view user details. This could lead to the exposure of sensitive information such as email addresses and assigned security roles.

CVSS 3.1 · 4.9 Medium EPSS < 1% KEV · Not listed
Vendors
Red Hat Redhat
Products
Red Hat Build Of Keycloak 26.4 Build Keycloak Build Of Keycloak and 2 more
CVE-2026-94215

Keycloak-services: keycloak-services: cross-realm client read/write via request-level cache missing realm ownership check

A flaw was found in the Admin REST API of Keycloak, an open-source identity and access management solution. The issue occurs because the API uses a per-request in-memory cache to resolve clients by their unique identifier without verifying if the client belongs to the realm specified in the request path. This allows an administrator with limited privileges to read or modify sensitive client configurations in the master realm by accessing them through a realm they control. Successful exploitation could lead to the exposure of client credentials or the redirection of administrative login attempts to malicious sites.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Red Hat Redhat
Products
Red Hat Build Of Keycloak 26.4 Build Keycloak Build Of Keycloak and 2 more
CVE-2026-94217

Keycloak-services: keycloak-services: uma scope merge across resource owners via resource name collision

A flaw was found in the User-Managed Access (UMA) implementation of Keycloak. The issue occurs in the authorization token endpoint when processing permission tickets. If two different users own resources with the same name, the system incorrectly merges the permissions from both resources when one user requests an authorization token. This allows an attacker to gain access scopes on a victim's resource that were never intended to be shared.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed
Vendors
Red Hat Redhat
Products
Red Hat Build Of Keycloak 26.4 Build Keycloak Build Of Keycloak and 2 more
CVE-2026-94218

Keycloak-services: keycloak-services: 2fa setup enforcement bypass via authentication session restart endpoint

A flaw was found in the authentication session management of Keycloak, an identity and access management solution. The issue occurs when an administrator enforces a stronger authentication flow, such as mandatory two-factor authentication (2FA) setup, through a client policy. A user can bypass this requirement by manually visiting a specific session restart web link during the login process. This action clears the internal markers that track the required security steps, allowing the user to log in with only a password and gain access without completing the mandated 2FA setup.

CVSS 3.1 · 3.1 Low EPSS < 1% KEV · Not listed
Vendors
Red Hat Redhat
Products
Red Hat Build Of Keycloak 26.4 Build Keycloak Build Of Keycloak and 2 more
CVE-2026-103112

Keycloak-services: keycloak-services: account takeover via authentication race using reset-credentials path

A flaw was found in the authentication session handling of the keycloak-services component in Keycloak. The issue occurs because the system fails to verify if an authenticator is valid for the current authentication flow when switching between the standard authentication path and the reset credentials path. An authenticated attacker can exploit this by triggering a race condition during the credential reset process to associate their successful authentication state with another user's session. This can result in the attacker gaining full access to the victim's account and changing their password.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Red Hat Redhat
Products
Red Hat Build Of Keycloak 26.4 Build Keycloak Build Of Keycloak and 2 more
CVE-2026-92855

Keycloak-services: keycloak-services: saml broker accepts holder-of-key assertions without proof of key possession

A flaw was found in the SAML identity broker component of Keycloak, which is used to delegate authentication to external identity providers. The issue occurs because the broker fails to verify that a user actually possesses the private key associated with a holder-of-key assertion. An attacker who intercepts a victim signed assertion can replay it to gain unauthorized access and impersonate the victim without needing their private key.

CVSS 3.1 · 7.4 High EPSS < 1% KEV · Not listed
Vendors
Red Hat Redhat
Products
Red Hat Build Of Keycloak 26.4 Build Keycloak Build Of Keycloak and 2 more
CVE-2026-107602

Keycloak-services: keycloak-services: unauthenticated cpu exhaustion via saml 1.1 keyinfo infinite loop

A flaw was found in the SAML 1.1 XML parsing logic of Keycloak, an open-source identity and access management solution. The issue occurs when the parser encounters unexpected elements within a security token's key information section, causing the processing thread to enter an infinite loop. An unauthenticated remote attacker could exploit this by sending specially crafted requests, leading to 100% CPU usage and a total denial of service that requires a server restart to resolve.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Red Hat Redhat
Products
Red Hat Build Of Keycloak 26.4 Build Keycloak Build Of Keycloak and 2 more
CVE-2026-92857

Keycloak-services: keycloak-services: dcr protocol mapper config not validated, allowing iat holders to forge sub and aud claims in signed tokens

Keycloak provides a Dynamic Client Registration feature that allows users with specific tokens to register their own applications. A flaw in how Keycloak validates these registration requests allows an attacker to create a malicious application that forges identity information. By mapping their own user profile details to protected fields like the user ID (sub) or intended audience (aud), an attacker can generate signed security tokens that make them appear to be a different user. This could allow an attacker to impersonate other users or gain unauthorized access to services that rely on these tokens for identity verification.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Red Hat Redhat
Products
Red Hat Build Of Keycloak 26.4 Build Keycloak Build Of Keycloak and 2 more
CVE-2026-110931

Keycloak-services: keycloak-services: unauthenticated jvm termination via saml 1.1 authoritybinding parsing loop

A flaw was found in the SAML 1.1 assertion parser of Keycloak, a tool used for identity and access management. The issue occurs when the parser handles a specific element called AuthorityBinding within an authentication statement. Due to an incomplete fix for a previous vulnerability, the parser can enter an infinite loop that consumes all available memory, causing the entire Keycloak service to crash and become unavailable to users.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Red Hat Redhat
Products
Red Hat Build Of Keycloak 26.4 Build Keycloak Build Of Keycloak and 2 more
CVE-2026-112208

Keycloak-services: keycloak-services: account takeover via stale sso_auth note in organization identity-first login

A flaw was found in the Organization identity-first login flow of the Keycloak authentication server. Keycloak is an open-source identity and access management solution used to secure modern applications and services. The issue occurs when an attacker who belongs to multiple organizations initiates a login and then switches to a registration or password reset path. During this process, a flag indicating a successful login is not properly cleared when the user is removed from the session. An attacker can then provide a victim's username, and the system incorrectly treats the stale flag as proof of the victim's identity. This allows the attacker to bypass authentication and gain full access to the victim's account and connected applications.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Red Hat Redhat
Products
Red Hat Build Of Keycloak 26.4 Build Keycloak Build Of Keycloak and 2 more
CVE-2026-120984

Keycloak-services: keycloak-services: manage-clients to arbitrary code execution through inline javascript policy import

A flaw was found in the Keycloak server's client management component. When a client is created or imported with authorization services enabled, the system fails to properly clear an internal session attribute used during the setup process. This allows an authenticated attacker with client management permissions to bypass security controls and upload a malicious JavaScript policy, which is then executed on the server when an authorization request is made. Successful exploitation could allow the attacker to run arbitrary code on the server, potentially compromising the entire system.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Red Hat Redhat
Products
Red Hat Build Of Keycloak 26.4 Build Keycloak Build Of Keycloak and 2 more
CVE-2026-117691

Keycloak-services: keycloak-services: saml redirect binding signature bypass via percent-encoded parameter names

A flaw was found in the SAML HTTP-Redirect binding implementation of Keycloak. The issue occurs because the server processes percent-encoded parameter names (like %53AMLResponse) while the signature verification logic only checks literal parameter names. An attacker can use this discrepancy to provide a crafted, unsigned SAML message that the server processes instead of a legitimately signed one, leading to full account takeover of federated users.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Red Hat Redhat
Products
Red Hat Build Of Keycloak 26.4 Build Keycloak Build Of Keycloak and 2 more
CVE-2026-18569

Keycloak-services: keycloak-services: oidc backchannel logout accepts unsigned forged logout tokens

A flaw was found in the backchannel logout endpoint of the keycloak-services component, which is part of the Red Hat Build of Keycloak. This component handles authentication and session management for applications. The issue occurs when an OIDC identity provider is configured to skip signature validation. In this specific setup, the system incorrectly accepts logout requests that have no cryptographic signature. An attacker who knows certain technical details about a user's session can use this flaw to force that user to be logged out, potentially disrupting their work.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Build Keycloak Build Of Keycloak Jboss Data Grid and 3 more
CVE-2026-18206

Keycloak-services: keycloak-services: client policy source-host wildcard domain matching bypass

A flaw was found in the keycloak-services component of Keycloak, which provides identity and access management services. The issue occurs when a realm administrator uses a wildcard domain (like *.example.com) to restrict which hosts can register or update clients. Due to improper validation, the system accepts any hostname that ends with the specified domain suffix, even if it is not a legitimate subdomain. An attacker who can control the reverse DNS of their connection can bypass these host-based restrictions, potentially allowing unauthorized client modifications.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Build Keycloak Build Of Keycloak Data Grid and 5 more
CVE-2026-9797

Keycloak: keycloak: privilege escalation via client authentication manipulation by an authenticated administrator

A flaw was found in Keycloak's administrative services (org.keycloak.services.resources.admin). A highly privileged attacker, authenticated with a 'manage-clients' role, could exploit this vulnerability through several methods, including manipulating client JSON Web Key Sets (JWKS), swapping client authenticator types and resetting secrets, or downloading legitimate signing keys. Successful exploitation allows the attacker to obtain a token with 'realm-admin' role assignments, leading to privilege escalation and potential unauthorized access to sensitive resources.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Red Hat Redhat
Products
Red Hat Build Of Keycloak 26.4 Build Keycloak Build Of Keycloak