Critical: Red Hat build of Keycloak 26.6.6 Security Update

Red Hat build of Keycloak is an integrated sign-on solution,available as a Red Hat JBoss Middleware for OpenShift containerizedimage. The Red Hat build of Keycloak for OpenShift image providesan authentication server that you can use to log in centrally, logout, and register. You can also manage user accounts for webapplications, mobile applications, and RESTful web services.Red Hat build of Keycloak Operator for OpenShift simplifiesdeployment and management of Keycloak 26.4.14 clusters.This erratum releases new images for Red Hat build of Keycloak26.4.14 for use within the OpenShift Container Platform cloudcomputing Platform-as-a-Service (PaaS) for on-premise or privatecloud deployments, aligning with the standalone product release.Security fixes: Admin UI extension brute-force-user endpoint bypasses FGAPv2 user view restrictions (CVE-2026-14209) FGAP v2 client scope assignment bypass via ClientResource (CVE-2026-14614) FGAP v2 parent group children endpoint bypasses per-child view permission filter (CVE-2026-14615) DCR protocol mapper type-swap policy bypass allows privilege escalation (CVE-2026-15572) Authorization bypass via unnormalized URI matching in PathMatcher (CVE-2026-15573) LDAP entry-DN user search bypasses configured users DN boundary (CVE-2026-16071) Default DCR policy allows role forgery via User Property mappers (CVE-2026-16102) Quarkus REST - Unbounded multipart MIME part-header accumulation allows remote OOM denial of service (CVE-2026-16308) SAML IdP-initiated broker login bypasses link-only restriction (CVE-2026-16442) SAML broker metadata import disables response signature validation (CVE-2026-16443) Privilege escalation through hardcoded role mapper injection (CVE-2026-4629) Arbitrary code execution via PolymorphicTypeValidator bypass (CVE-2026-54512) Security bypass allows arbitrary code execution (CVE-2026-54513) HTTP Parameter Pollution in OIDC redirect URI allows response parameter duplication - #GHI-604 (CVE-2026-9689) Security policy bypass in JWE-encrypted request object processing (CVE-2026-9793) Brute-force protection bypass in CIBA flow (CVE-2026-9798) Authorization bypass via incorrect URI comparison (CVE-2026-9800) Brute-force protection bypass in CIBA flow (CVE-2026-9798)

Important: Red Hat build of Keycloak 26.6.5 Security Update

Important: Red Hat build of Keycloak 26.6.5 Images Security Update

Red Hat build of Keycloak 26.4.14 is a standalone server, based onthe Keycloak project, that provides authentication andstandards-based single sign-on capabilities for web and mobileapplications.Security fixes: Admin UI extension brute-force-user endpoint bypasses FGAPv2 user view restrictions (CVE-2026-14209) FGAP v2 client scope assignment bypass via ClientResource (CVE-2026-14614) FGAP v2 parent group children endpoint bypasses per-child view permission filter (CVE-2026-14615) DCR protocol mapper type-swap policy bypass allows privilege escalation (CVE-2026-15572) Authorization bypass via unnormalized URI matching in PathMatcher (CVE-2026-15573) LDAP entry-DN user search bypasses configured users DN boundary (CVE-2026-16071) Default DCR policy allows role forgery via User Property mappers (CVE-2026-16102) Quarkus REST - Unbounded multipart MIME part-header accumulation allows remote OOM denial of service (CVE-2026-16308) SAML IdP-initiated broker login bypasses link-only restriction (CVE-2026-16442) SAML broker metadata import disables response signature validation (CVE-2026-16443) Privilege escalation through hardcoded role mapper injection (CVE-2026-4629) Arbitrary code execution via PolymorphicTypeValidator bypass (CVE-2026-54512) Security bypass allows arbitrary code execution (CVE-2026-54513) HTTP Parameter Pollution in OIDC redirect URI allows response parameter duplication - #GHI-604 (CVE-2026-9689) Security policy bypass in JWE-encrypted request object processing (CVE-2026-9793) Brute-force protection bypass in CIBA flow (CVE-2026-9798) Authorization bypass via incorrect URI comparison (CVE-2026-9800)

An incomplete fix for CVE-2026-9689 was identified in Keycloak's RedirectUtils.containsForbiddenOidcParameters() method. While the original fix successfully blocks forbidden OIDC parameters (such as code, state, and iss) in the URI query string, it fails to inspect the URI fragment (#). When a client is configured with a wildcard redirect URI, an attacker can supply a redirecturi containing these forbidden parameters within the fragment. Because matchesRedirects strips fragments during prefix matching, the crafted URI is accepted. During the authorization response, Keycloak appends its own parameters to the attacker-supplied fragment, leading to a polluted response where attacker-controlled values appear first. Exploitation Conditions: The target client must have a wildcard-registered redirect URI (e.g., https://app.example.com/).

The attacker must induce a victim to follow a crafted authorization URL.

The relying party (client application) must use a first-wins parsing strategy for duplicate parameters.

Concrete Impact: Injection of attacker-controlled iss (issuer), state, and accesstoken parameters.

Potential for session fixation or account confusion if the relying party does not validate parameters per RFC 9207.

A flaw was found in the SAML metadata import functionality of the keycloak-services component, which is the core engine for identity brokering in Red Hat Build of Keycloak. When importing identity provider metadata that lacks specific usage attributes for keys, the system incorrectly disables signature validation for SAML responses even if a signing certificate is provided. This issue allows an unauthenticated attacker to forge a SAML response and gain unauthorized access to a user account by knowing their external identifier.

A flaw was found in Keycloak where the default Dynamic Client Registration (DCR) policy permits the use of User Property mappers without validating the target claim path. While the policy checks the mapper provider type, it does not restrict where the mapper can write data within the resulting token. An attacker with a standard user account and a limited Initial Access Token (IAT) can register a new client and configure User Property mappers (such as firstName or lastName) to target the resourceaccess.realm-management.roles claim path. By setting their user profile properties to administrative role names (e.g., manage-clients, realm-admin), the attacker can produce a forged access token containing these roles. Although recent mitigations (CVE-2026-4629) protect the Admin REST API from such forged tokens, the Client Registration API remains vulnerable because it reads the resourceaccess claim directly during authorization. An attacker can use this bypass to perform unauthorized DCR operations, including reading confidential client secrets, modifying redirect URIs, and impersonating service accounts to achieve full realm compromise.

Latest version: 26.7.3

HCL Hive Telco Observability is affected by  a Required directives missing from the CSP issue is detected in keycloak component of the web application. Missing essential directives can leave a site vulnerable.

A flaw was found in Keycloak. A remote attacker with high privileges, such as a realm administrator configuring a malicious Lightweight Directory Access Protocol (LDAP) server or an attacker compromising an upstream LDAP server, could exploit this vulnerability. By sending a malformed LDAP password policy response during a password authentication request, the attacker can trigger an OutOfMemoryError. This causes the Keycloak Java Virtual Machine (JVM) to terminate, leading to a denial of service (DoS) for all realms on the affected node.

A flaw was found in Keycloak, an open-source identity and access management solution. When a user account is temporarily locked due to repeated failed login attempts, an attacker with valid client credentials can exploit the Client-Initiated Backchannel Authentication (CIBA) flow to bypass this brute-force protection. This allows continued authentication attempts and token issuance even when the account should be locked, potentially enabling further unauthorized access attempts.

A flaw was found in Keycloak. When a JSON Web Encryption (JWE) encrypted request object is submitted, Keycloak may incorrectly process unsigned claims if the decrypted content is raw JSON, bypassing the configured signature policy. This allows a remote attacker to submit unauthorized claims, leading to a compromise of data integrity within the OpenID Connect (OIDC) authorization flow. While a redirect URI allowlist acts as a compensating control, this vulnerability violates OIDC Core and Financial-grade API (FAPI) signing requirements.

A flaw was found in Keycloak. An authenticated user with low privileges can exploit this vulnerability by sending an oversized subjecttoken JSON Web Token (JWT) to the TokenEndpoint. When the token exceeds a 4000-character limit, it is silently dropped, causing the system to fall back to client credentials. This allows the user to gain the permissions of the client's service account, leading to privilege escalation.

OIDC Introspection fails to honor realm-level notBefore revocation policies when a client-level notBefore value is also present, allowing revoked tokens to remain active.

When Keycloak is started with --features-disabled=account,account-api, the Account REST API is only partially disabled. Five endpoints under the versioned path /account/v1alpha1 remain fully functional — including both read and write operations — because they lack the checkAccountApiEnabled() gate that correctly blocks four other endpoints in the same REST service class. The user needs to have permissions to use the API.

End of life: 7/9/2026, Latest version: 26.6.4

Authentication / credential-enrollment vulnerability in Keycloak’s handling of ExecuteActionsActionToken for WebAuthn flows. The flaw is caused by canUseTokenRepeatedly() treating tokens as reusable when required actions do not mark themselves as one-time, so tokens containing WEBAUTHNREGISTER or WEBAUTHNPASSWORDLESSREGISTER can be replayed within their validity window. When an attacker gains access to an execute-actions email link, they can complete WebAuthn registration with their own authenticator on the victim’s account before the victim uses it. This can be exploited remotely when WebAuthn required actions are enabled and the link is obtained via email interception, log leakage, or mailbox compromise. Successful exploitation results in unauthorized enrollment of a hardware-backed credential, enabling stealthy and persistent account takeover.

Stored Cross-Site Scripting (XSS) vulnerability in the organization selection login page of Keycloak. The flaw is caused by placing organization.alias into an inline JavaScript onclick handler, where browser HTML decoding bypasses FreeMarker’s HTML escaping. When an attacker-controlled alias containing a crafted JavaScript payload is rendered on the organization selection page, the payload can execute in the context of any user’s browser. This can be exploited remotely by an admin with manage-realm or manage-organizations privileges, without further user interaction beyond viewing the login page. Successful exploitation allows execution of arbitrary JavaScript, enabling session theft, account actions, or further attacks against users of the affected realm.

CORS header injection vulnerability in Keycloak’s UMA token endpoint. The flaw is caused by reading the azp claim from a client-supplied JWT to set the Access-Control-Allow-Origin header before the JWT signature is validated. When a specially crafted JWT with an attacker-controlled azp value is processed, that value is reflected as the CORS origin even though the grant is later rejected. This can be exploited remotely without authentication when a target client is misconfigured with webOrigins: [""]. Attackers can then read UMA error responses cross-origin, weakening origin isolation and exposing low-sensitivity information from the authorization server.

The vulnerability is a UMA policy bypass in the /realms/{realm}/authz/protection/uma-policy/{resourceId} endpoint. The create-path validation only checks ownership for the resource ID in the URL path, but the request body accepts a "resources" array that can include additional resource IDs owned by other users. When the policy is created, it grants the attacker permissions to all listed resources, including victim-owned ones. The attacker can then request an RPT (Requesting Party Token) for victim resources and receive valid permissions.

Requirements to exploit: Authenticated user with umaprotection role, victim must have created UMA-protected resources with ownerManagedAccess enabled, authorization services enabled on the client.

Steps to reproduce:

1. Deploy Keycloak with a client configured with authorizationServicesEnabled:true 2. Create two users (attacker, victim) and assign both the umaprotection client role 3. As victim, create a UMA resource via POST /realms/{realm}/authz/protection/resourceset with ownerManagedAccess:true and scopes:["view"] → note the victimresourceid 4. As attacker, obtain access token and create own UMA resource via same endpoint → note the attackerresourceid 5. As attacker, POST to /realms/{realm}/authz/protection/uma-policy/{attackerresourceid} with body: {"name":"malicious-policy","scopes":["view"],"users":["attacker"],"resources":["{attackerresourceid}","{victimresourceid}"]} 6. Observe policy creation succeeds (HTTP 200) despite including victim-owned resource 7. As attacker, POST to /realms/{realm}/protocol/openid-connect/token with granttype=urn:ietf:params:oauth:grant-type:uma-ticket, audience={clientid}, permission={victimresourceid}#view 8. Attacker receives valid RPT (HTTP 200) containing permissions for victim resource, which was denied (HTTP 403) before the exploit

When receiving a POST request on the OpenID Connect token endpoint, Keycloak fails to limit the passed-in scopes, which leads to a high resource usage in Keycloak.

1. Generate a long list of scopes

SCOPE5K=$(python3 -c "print(' '.join(['scope'+str for i in range(5000)]))") echo "Scope parameter length: ${#SCOPE5K} bytes"

2. Post a ROPC Grant:

time curl -s -o /dev/null -w "admin-cli 5K scopes: HTTP %{httpcode} (%{timetotal}s)\n" \ -X POST "${KCURL}/realms/master/protocol/openid-connect/token" \ -d "granttype=password&clientid=admin-cli&username=x&password=x&scope=${SCOPE5K}"

Root cause: TokenManager.getRequestedClientScopes() at line 658 performs String.contains() on the entire scope parameter string for each default client scope, resulting in O(n²) processing time.

A single POST request with ~49KB of scope values causes 38.6 seconds of server-side processing; with ~99KB it reaches 151.8 seconds

The same problem occurs for client credential grants and token refreshes - in the case of token refreshes the problem occurs even before checking the token, so any token can be used, allowing any unauthenticated attacker to perform this.

A flaw was found in Keycloak. A remote attacker can exploit differential error messages during the identity-first login flow when Organizations are enabled. This vulnerability allows an attacker to determine the existence of users, leading to information disclosure through user enumeration.

Server-Side Request Forgery (SSRF) vulnerability in Keycloak due to improper handling of HTTP redirects during client configuration processing. The flaw arises because Keycloak follows redirect responses (e.g., HTTP 302) without validating the final destination URL. An attacker can supply a crafted sectoridentifieruri that initially matches allowed patterns but redirects to internal resources such as cloud metadata endpoints (e.g., 169.254.169.254). This causes Keycloak to issue unintended requests from its network context, enabling blind SSRF. The vulnerability can be exploited remotely without authentication or user interaction, allowing attackers to perform internal network reconnaissance and potentially access sensitive information.

A flaw was found in Keycloak. The SingleUseObjectProvider, a global key-value store, lacks proper type and namespace isolation. This vulnerability allows an attacker to delete arbitrary single-use entries, which can enable the replay of consumed action tokens, such as password reset links. This could lead to unauthorized access or account compromise.

Keycloak's SingleUseObjectProvider is a global flat key-value store used without type or namespace isolation. This allows an attacker to delete arbitrary single-use entries, enabling the replay of consumed action tokens such as password reset links. Requirements to exploit:

A flaw was found in Keycloak. The SingleUseObjectProvider, a global key-value store, lacks proper type and namespace isolation. This vulnerability allows an unauthenticated attacker to forge authorization codes. Successful exploitation can lead to the creation of admin-capable access tokens, resulting in privilege escalation.

Keycloak's SingleUseObjectProvider is a global flat key-value store used by multiple features without type or namespace isolation. This allows an unauthenticated attacker to forge authorization codes and mint admin-capable access tokens.

A flaw was found in Keycloak's redirecturi validation logic. This issue may allow bypassing the allwed path in a redirect URIs that use a wilcard. A successful attack may lead to the theft of an access token if the attacker controls another path on the same web server.

Important: Red Hat build of Keycloak 26.4.10 Update