A flaw was found in the group policy provider of Keycloak authorization services, which is used to manage fine-grained access control to resources. The issue occurs when the system evaluates group-based policies using tokens that only contain group names rather than full paths. If two groups in different parts of the organization share the same name, a user in the unauthorized group can be mistaken for a member of the authorized group. This can allow a user to gain unauthorized access to protected resources they should not be able to reach.

A flaw was found in the backchannel logout endpoint of the keycloak-services component, which is part of the Red Hat Build of Keycloak. This component handles authentication and session management for applications. The issue occurs when an OIDC identity provider is configured to skip signature validation. In this specific setup, the system incorrectly accepts logout requests that have no cryptographic signature. An attacker who knows certain technical details about a user's session can use this flaw to force that user to be logged out, potentially disrupting their work.

A flaw was found in the TokenManager.NotBeforeCheck logic within keycloak-services. The vulnerability occurs when a realm has a nonzero not-before timestamp (e.g., from a previous global revocation or import) and an administrator subsequently sets a newer client-specific not-before timestamp to revoke tokens for a single client. Due to a logic error in how these policies are compared (incorrectly prioritizing the older realm-level value or failing to evaluate the newer client-level value), the client-level revocation is ignored. An authenticated attacker holding OIDC tokens (access or refresh) issued after the realm not-before but before the client not-before can continue to use these tokens. Specifically, an attacker can successfully perform token refresh requests, receive an active status from the introspection endpoint, and retrieve user claims from the UserInfo endpoint, bypassing the intended revocation. ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

A flaw was found in the keycloak-services component of Keycloak, which handles OpenID Connect (OIDC) authentication flows. The issue occurs because the security check designed to prevent HTTP parameter pollution only inspects the query portion of a redirect URL and ignores the fragment portion. When a client is configured with a wildcard redirect URI, an attacker can use this to inject duplicate security parameters into the login response. If a client application is not configured correctly, it might trust the attacker's injected data instead of the real security information from Keycloak, leading to session fixation or account confusion.

A flaw was found in the OIDC token introspection endpoint of the keycloak-services component. Keycloak is an open-source identity and access management solution used to secure modern applications and services. The issue occurs when a confidential client, configured to receive signed JWT introspection responses, attempts to introspect a token issued for a different audience. Although the endpoint correctly identifies the token as inactive for that client, it still returns the full set of token claims within a signed JWT field. This allows an unauthorized client to bypass audience-based restrictions and access sensitive information contained in the token.

An information disclosure vulnerability was identified in Keycloaks OIDC token introspection endpoint. This flaw is an incomplete fix for CVE-2026-37979. While the original fix correctly enforced audience checks by marking out-of-audience tokens as inactive, it failed to sanitize the jwt field in the response when JWT introspection responses are enabled. The vulnerability exists in the keycloak-services component. When a confidential client with the client.introspection.response.allow.jwt.claim.enabled attribute set to true requests an application/jwt response, the server includes a signed JWT representation of the token even if the audience check fails. An attacker who controls a confidential client in the same realm and obtains a valid access token issued for a different client can exploit this to: Recover sensitive claims and attributes from lightweight or opaque tokens. Bypass audience-based access control mechanisms intended to restrict introspection metadata. Access internal identity information (roles, groups, user attributes) they are not authorized to view.

A flaw was found in the hostname matching logic within the ClientUpdaterSourceHostsCondition of Keycloak. When a wildcard domain (e.g., .example.com) is configured as a trusted source host in a client policy, the matching mechanism performs a simple suffix check without ensuring a proper subdomain boundary (a preceding dot). An unauthenticated attacker whose connecting IP address reverse-resolves to a crafted hostname ending in the trusted suffix (e.g., attackerexample.com) can satisfy the condition. This allows the attacker to bypass source-host restrictions intended to limit client registration or update operations to trusted domains. Successful exploitation causes policy executors to run as if the request originated from a legitimate trusted source, which can weaken or bypass security constraints applied to client management.

A flaw was found in the role-users endpoint of the keycloak-services library, which is the core component of the Keycloak identity and access management solution. The issue occurs because the system fails to check if an administrator has permission to view individual users when listing members of a role. This allows a restricted administrator to see private information, such as names and email addresses, for users they should not be able to access.

A flaw was found in the SAML broker component of Keycloak, which is used to manage identity federation and user authentication. The issue occurs because the IdP-initiated Single Sign-On endpoint fails to check if a provider is restricted to account linking only. This allows an attacker with control over a linked upstream identity to bypass login restrictions and gain full access to a local user account.

A vulnerability was found in the keycloak-services component where the SAML IdP-initiated broker login endpoint fails to enforce the link-only identity provider restriction. When a SAML identity provider is configured with linkOnly=true, it is intended to only allow users to link their accounts, not to use that provider for logging in. However, the endpoint at /realms/{realm}/broker/{alias}/endpoint/clients/{clientid} does not validate this setting. An attacker who controls an upstream SAML identity already linked to a Keycloak user can submit a valid signed SAML response directly to this endpoint. This allows the attacker to bypass the restriction and obtain a full authenticated session as the linked local user.

A flaw was found in the authentication configuration endpoint of the keycloak-services component, which is the core engine for Red Hat Build of Keycloak identity and access management. The issue occurs because the system fails to mask sensitive configuration values, such as reCAPTCHA secret keys, when they are requested by administrators with view-only permissions. This can lead to the exposure of third-party service credentials to unauthorized personnel or through administrative logs.

A flaw was found in the Secure Client Registration executor within the keycloak-services component. The vulnerability exists in the logic that enforces the signed-JWT assertion policy for client registration and updates. When the SecureSigningAlgorithmForSignedJwtExecutor is configured to require a client assertion, it only checks the alg field in the raw client assertion JWT header. It fails to validate that the client assertion type is present or that the client's actual authenticator is assertion-based. By providing a specially crafted request with an unsigned assertion header containing a valid alg field, an attacker with valid client credentials can bypass the signature verification check. This allows the attacker to successfully authenticate or update a client without providing the required cryptographic proof of identity. Successful exploitation allows an attacker to circumvent administrative security policies intended to restrict client authentication to trusted assertion-based methods.

A flaw was found in the Secure Client Registration executor within the keycloak-services component. The vulnerability exists in the logic that enforces the signed-JWT assertion policy for client registration and updates. When the SecureSigningAlgorithmForSignedJwtExecutor is configured to require a client assertion, it only checks the alg field in the raw client assertion JWT header. It fails to validate that the client assertion type is present or that the client's actual authenticator is assertion-based. By providing a specially crafted request with an unsigned assertion header containing a valid alg field, an attacker with valid client credentials can bypass the signature verification check. This allows the attacker to successfully authenticate or update a client without providing the required cryptographic proof of identity. Successful exploitation allows an attacker to circumvent administrative security policies intended to restrict client authentication to trusted assertion-based methods.

A flaw was found in the Keycloak keycloak-services component, which handles the management of identity providers. The issue occurs when a delegated administrator updates an OIDC identity provider using a masked client secret sentinel value. Due to improper validation, Keycloak reuses the existing real secret even if security-sensitive fields like the token URL have been changed, allowing an attacker to redirect and capture the secret.

A vulnerability was found in Keycloak-services. Special characters used during e-mail registration may perform SMTP Injection and unexpectedly send short unwanted e-mails. The email is limited to 64 characters (limited local part of the email), so the attack is limited to very shorts emails (subject and little data, the example is 60 chars). This flaw's only direct consequence is an unsolicited email being sent from the Keycloak server. However, this action could be a precursor for more sophisticated attacks.