REDHAT-BUG-2448061: High severity Red Hat Keycloak vulnerability

Published Mar 16, 2026

Updated

Keycloak's SingleUseObjectProvider is a global flat key-value store used by multiple features without type or namespace isolation. This allows an unauthenticated attacker to forge authorization codes and mint admin-capable access tokens.

Affected Software

1 affected component

Red Hat Keycloak

Event History

Mar 16, 2026

Data Sourced

via Red Hat·03:59 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

What is the severity of REDHAT-BUG-2448061?

The severity of REDHAT-BUG-2448061 is considered critical due to the potential for unauthenticated attackers to forge authorization codes.

How do I fix REDHAT-BUG-2448061?

To fix REDHAT-BUG-2448061, it is recommended to update to the latest version of Red Hat Keycloak that addresses this vulnerability.

What are the potential impacts of REDHAT-BUG-2448061?

The potential impacts of REDHAT-BUG-2448061 include the unauthorized issuance of admin-capable access tokens, leading to possible system compromise.

Who is affected by REDHAT-BUG-2448061?

REDHAT-BUG-2448061 affects all users of Red Hat Keycloak that utilize the SingleUseObjectProvider feature.

Is there a workaround for REDHAT-BUG-2448061?

Currently, there are no officially recommended workarounds for REDHAT-BUG-2448061; applying patches is the best mitigation.