A flaw was found in Keycloak's administrative services (org.keycloak.services.resources.admin). A highly privileged attacker, authenticated with a 'manage-clients' role, could exploit this vulnerability through several methods, including manipulating client JSON Web Key Sets (JWKS), swapping client authenticator types and resetting secrets, or downloading legitimate signing keys. Successful exploitation allows the attacker to obtain a token with 'realm-admin' role assignments, leading to privilege escalation and potential unauthorized access to sensitive resources.
A flaw was found in the Client-Initiated Backchannel Authentication (CIBA) implementation of Keycloak. The CIBA endpoint fails to properly validate the sub parameter, allowing it to be stored as an additional request parameter. During the token issuance process, this injected value overwrites the legitimate subject identifier. This allows an attacker to authenticate as themselves but receive security tokens belonging to a different victim user, leading to unauthorized account access.
A flaw was found in the authentication session handling of the keycloak-services component in Keycloak. The issue occurs because the system fails to verify if an authenticator is valid for the current authentication flow when switching between the standard authentication path and the reset credentials path. An authenticated attacker can exploit this by triggering a race condition during the credential reset process to associate their successful authentication state with another user's session. This can result in the attacker gaining full access to the victim's account and changing their password.
A flaw was found in Keycloak where an authenticated attacker with delegated client management permissions (manage-clients) can achieve arbitrary code execution. When a client is created with authorization services enabled and an authorizationSettings payload is provided in the same request, Keycloak sets an internal session attribute to allow the creation of a default policy but fails to clear it. This mechanism can be abused to supply an inline JavaScript policy during client import, bypassing the security control that normally disables script uploads. When the policy is subsequently evaluated during a User-Managed Access (UMA) authorization request, the injected JavaScript executes within the Keycloak server JVM process. This allows an attacker to escape the delegated administrator's realm boundary and perform actions such as reading sensitive host data, modifying configurations for other realms, or causing a complete system shutdown.
A flaw was found in Keycloak where an authenticated attacker with delegated client management permissions (manage-clients) can achieve arbitrary code execution. When a client is created with authorization services enabled and an authorizationSettings payload is provided in the same request, Keycloak sets an internal session attribute to allow the creation of a default policy but fails to clear it. This mechanism can be abused to supply an inline JavaScript policy during client import, bypassing the security control that normally disables script uploads. When the policy is subsequently evaluated during a User-Managed Access (UMA) authorization request, the injected JavaScript executes within the Keycloak server JVM process. This allows an attacker to escape the delegated administrator's realm boundary and perform actions such as reading sensitive host data, modifying configurations for other realms, or causing a complete system shutdown.
A flaw was found in the secure-redirect-uris-enforcer client policy of Keycloak, an identity and access management solution. The issue occurs when the policy is configured to allow loopback addresses, as Keycloak resolves hostnames via DNS during validation. An attacker can bypass domain allowlist restrictions by using a hostname that resolves to a loopback address, potentially allowing the registration of unauthorized redirect URIs.
A flaw was found in the required action provider mechanism of Keycloak. The issue occurs when an authorization request includes the kcaction query parameter set to a mandatory action already assigned to the user, such as profile verification or terms and conditions. Due to incorrect handling of application-initiated actions, Keycloak may skip these mandatory challenges and issue an authorization code. This can allow a user to bypass administrative requirements and gain access to the application without completing necessary profile updates or agreeing to terms.
A flaw was found in the UMA resource registration endpoint of the keycloak-services component, which provides the core logic for Keycloak's authorization and identity services. The issue occurs when remote resource management is enabled, allowing an authenticated user with specific permissions to update resources they do not own by providing a target resource ID in a request. This can lead to unauthorized modification of resource configurations, such as names, URIs, and scopes.
A flaw was found in the HOTP authentication mechanism of the keycloak-services component, which provides identity and access management services. The issue occurs because the system validates a one-time password and updates its internal counter in two separate steps without proper locking. An attacker with a users password could exploit this timing gap to use a single one-time code to log in multiple times simultaneously.
A race condition vulnerability was found in Keycloak within the HOTP HMAC-based One-Time Password validation logic in keycloak-services. When a realm is configured with an HOTP policy, the operations to validate a submitted code and increment the HOTP counter are performed non-atomically and without concurrency locking. An attacker who has already obtained a valid users credentials and a single valid HOTP code can send multiple concurrent authentication requests to the OpenID Connect token endpoint. Because of the lack of synchronization, multiple requests may be validated against the same counter value before it is successfully incremented. This allows an attacker to bypass the one-time use restriction of the HOTP code and establish multiple concurrent authenticated sessions.
A flaw was found in Keycloaks Pushed Authorization Request PAR implementation. The fix for CVE-2026-96446 moved PAR consumption to authentication completion by checking for the AUTHORIZATIONREQUESTURI authentication session note. However, triggering an authentication flow restart via /login-actions/restart clears authentication session notes while preserving client notes including request parameters such as redirecturi, scope, state, and nonce. Consequently, when authentication completes after a flow restart, the PAR consumption check is skipped, leaving the requesturi active in the single-use store. An attacker can replay the same requesturi within its valid lifespan default 60 seconds to obtain a second authorization grant and distinct access token. This bypasses the single-use guarantee required by RFC 9126. Successful exploitation allows an attacker to mint multiple authorization codes and access tokens from a single pushed request.
A flaw was found in Keycloaks Pushed Authorization Request PAR implementation. The fix for CVE-2026-96446 moved PAR consumption to authentication completion by checking for the AUTHORIZATIONREQUESTURI authentication session note. However, triggering an authentication flow restart via /login-actions/restart clears authentication session notes while preserving client notes including request parameters such as redirecturi, scope, state, and nonce. Consequently, when authentication completes after a flow restart, the PAR consumption check is skipped, leaving the requesturi active in the single-use store. An attacker can replay the same requesturi within its valid lifespan default 60 seconds to obtain a second authorization grant and distinct access token. This bypasses the single-use guarantee required by RFC 9126. Successful exploitation allows an attacker to mint multiple authorization codes and access tokens from a single pushed request.
A signature bypass vulnerability was identified in Keycloak's SAML HTTP-Redirect binding. The root cause is a discrepancy between how the server parses query parameters for processing versus how it parses them for signature verification. Specifically, the server decodes percent-encoded parameter names (e.g., %53AMLResponse becomes SAMLResponse) during processing, but the signature verification logic re-parses the raw query string and only recognizes literal parameter names. By sending a GET request where a crafted, unsigned SAMLResponse is placed first using a percent-encoded name, followed by a legitimately signed SAMLResponse, an attacker can bypass the signature check. The signature check validates the second (legitimate) message, but the server processes the first (crafted) message because it is the first occurrence of the decoded parameter name. Successful exploitation allows an unauthenticated remote attacker to perform a full account takeover of any federated user by impersonating their identity in the SAML assertion. This requires the attacker to have their own account at the external Identity Provider to capture a validly signed redirect-binding message (such as a logout response) to use in the bypass. ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
A flaw was found in the SAML HTTP-Redirect binding implementation of Keycloak. The issue occurs because the server processes percent-encoded parameter names (like %53AMLResponse) while the signature verification logic only checks literal parameter names. An attacker can use this discrepancy to provide a crafted, unsigned SAML message that the server processes instead of a legitimately signed one, leading to full account takeover of federated users.
A sensitive information disclosure flaw was found in the org.keycloak.services.clientregistration component of Keycloak. The issue arises when Keycloak is configured with an active Vault provider and Dynamic Client Registration endpoints are enabled. An authenticated attacker holding a valid Registration Access Token (RAT) for a confidential client can update the client secret to a Vault reference expression, such as vault.alias. When the attacker subsequently requests the client installation configuration through the registration endpoint, Keycloak improperly resolves the Vault expression and returns the managed secret in plaintext. An attacker with knowledge of existing Vault secret aliases in the realm can exploit this to read arbitrary Vault values without possessing administrative privileges.
A flaw was found in the Update User Locale required action of the Keycloak identity and access management solution. When this action is ordered before the Configure OTP action in a realm, the system may fail to enforce mandatory multi-factor authentication enrollment during the login process. This issue allows an attacker with a valid password to access an account without setting up the required one-time password (OTP) credential.
A flaw was found in the UserManagedPermissionService of the Keycloak authorization server. The UMA Protection API, which manages user permissions, fails to validate the resourceType field when a user creates a new policy. This allows an attacker to create a policy that applies to resources owned by other users, potentially leading to unauthorized access or modification of sensitive data across the entire realm.
A Missing Authorization vulnerability was identified in Keycloaks UMA Protection API. The issue exists in the UserManagedPermissionService where the resourceType field is not validated during policy creation. An authenticated user with the ability to create their own resources can craft a policy request specifying a resourceType that they do not own. During evaluation in the DefaultPolicyEvaluator, the authorization server matches this policy against all resources of that type, regardless of ownership. Exploitation requires the attacker to be an authenticated realm user with at least one resource and knowledge of the victims resourceType string. Successful exploitation allows an attacker to obtain a Requesting Party Token (RPT) that grants access to resources owned by other users, enabling them to view sensitive information or perform unauthorized actions on those resources.
A flaw was found in the Keycloak Organization identity-first login flow. The vulnerability is caused by a failure to clear the SSO re-authentication flag (SSOAUTH note) when a flow transition occurs, such as moving to the reset-credentials or registration path, even though the authenticated user is removed from the authentication session. An attacker with valid credentials in two or more organizations can exploit this by initiating an organization-scoped authorization request, triggering a flow transition, and then submitting a victim's username. The Organization authenticator incorrectly trusts the stale re-authentication flag as valid proof of identity for the new username. Successful exploitation allows a remote attacker with Low privileges to perform a full account takeover, obtaining the victim's authorization code, access tokens, and a valid SSO session usable against downstream applications.
A flaw was found in the Keycloak Organization identity-first login flow. The vulnerability is caused by a failure to clear the SSO re-authentication flag (SSOAUTH note) when a flow transition occurs, such as moving to the reset-credentials or registration path, even though the authenticated user is removed from the authentication session. An attacker with valid credentials in two or more organizations can exploit this by initiating an organization-scoped authorization request, triggering a flow transition, and then submitting a victim's username. The Organization authenticator incorrectly trusts the stale re-authentication flag as valid proof of identity for the new username. Successful exploitation allows a remote attacker with Low privileges to perform a full account takeover, obtaining the victim's authorization code, access tokens, and a valid SSO session usable against downstream applications.
A flaw was found in the theme resource endpoint of Keycloak, an open-source identity and access management solution. The issue occurs because the server fails to validate theme names before using them as keys for an on-disk gzip cache. An unauthenticated attacker can exploit this by sending many requests with unique, fabricated theme names, leading to persistent disk space exhaustion that survives server restarts and causes service disruptions.
A Resource Exhaustion vulnerability was found in Keycloaks theme resource endpoint (/resources/{version}/{themeType}/{themeName}/{path}). The root cause is improper validation of the themeName parameter when theme caching is enabled and the client requests gzip encoding. While the server resolves unknown theme names to a default theme, it uses the attacker-provided name to create a permanent file in the data/tmp/kc-gzip-cache/ directory. Because these entries are never expired or bounded, an unauthenticated remote attacker can send a high volume of requests with unique theme names to fill the servers disk. Successful exploitation leads to a persistent Denial of Service where legitimate theme assets return 404 errors and other disk-dependent operations, such as logging and transaction processing, fail.
A flaw was found in the SAML 1.1 assertion parser of Keycloak, a tool used for identity and access management. The issue occurs when the parser handles a specific element called AuthorityBinding within an authentication statement. Due to an incomplete fix for a previous vulnerability, the parser can enter an infinite loop that consumes all available memory, causing the entire Keycloak service to crash and become unavailable to users.
A flaw was found in Keycloaks implementation of the Client-Initiated Backchannel Authentication CIBA grant. Although the CIBA specification and Keycloaks internal contract intend for this flow to be restricted to confidential clients, the enforcement mechanism is missing at both the backchannel-authentication and token endpoints. While bearer-only clients are correctly rejected, public clients which authenticate using only a client-id are permitted to proceed. An attacker can exploit this by using a public client to initiate a CIBA flow for a known user via login-hint. If the targeted user approves the resulting push notification on their authentication device, the attacker can redeem the auth-req-id at the token endpoint to obtain a valid user access token. This allows the attacker to perform any action the user is authorized to do and access their private information, all without ever possessing a client secret or valid credentials.
A flaw was found in Keycloaks implementation of the Client-Initiated Backchannel Authentication CIBA grant. Although the CIBA specification and Keycloaks internal contract intend for this flow to be restricted to confidential clients, the enforcement mechanism is missing at both the backchannel-authentication and token endpoints. While bearer-only clients are correctly rejected, public clients which authenticate using only a client-id are permitted to proceed. An attacker can exploit this by using a public client to initiate a CIBA flow for a known user via login-hint. If the targeted user approves the resulting push notification on their authentication device, the attacker can redeem the auth-req-id at the token endpoint to obtain a valid user access token. This allows the attacker to perform any action the user is authorized to do and access their private information, all without ever possessing a client secret or valid credentials.
A flaw was found in the login theme rendering component of Keycloak. The issue occurs because the security filter responsible for cleaning user input can be bypassed, allowing a realm administrator to store malicious scripts in display fields. This could result in unauthorized JavaScript execution in the browsers of users visiting the login page, potentially leading to data exposure or session interference.
A flaw was found in the keycloak-services component. A copy-paste error in the OIDC Dynamic Client Registration response serialization prevents the backchannellogoutrevokeofflinetokens setting from being included in GET responses. When an authorized user or client performs a standard read-modify-write update (GET followed by PUT), the missing field is interpreted as false, silently disabling the revocation of offline tokens. An attacker with manage-clients or registration access can exploit this to ensure offline tokens survive backchannel logout events, maintaining unauthorized access after a session should have been terminated. Additionally, this bug causes the backchannellogoutsessionrequired status to be incorrectly overwritten.
A flaw was found in the keycloak-services component. A copy-paste error in the OIDC Dynamic Client Registration response serialization prevents the backchannellogoutrevokeofflinetokens setting from being included in GET responses. When an authorized user or client performs a standard read-modify-write update (GET followed by PUT), the missing field is interpreted as false, silently disabling the revocation of offline tokens. An attacker with manage-clients or registration access can exploit this to ensure offline tokens survive backchannel logout events, maintaining unauthorized access after a session should have been terminated. Additionally, this bug causes the backchannellogoutsessionrequired status to be incorrectly overwritten.
A flaw was found in the Admin REST installation provider endpoints and the Client Registration install endpoint in Keycloak. While the dedicated client-secret endpoint correctly enforces authorization, these specific endpoints fail to mask the client secret when accessed by a user with the realm-management:view-clients role. An authenticated attacker with this role can retrieve the cleartext secret of any confidential client using the client-secret authenticator. Successful exploitation allows the attacker to obtain a client-credentials access token and exercise the target client's service account permissions. This issue represents an incomplete fix for CVE-2026-89298.
A flaw was found in the Admin REST installation provider endpoints and the Client Registration install endpoint in Keycloak. While the dedicated client-secret endpoint correctly enforces authorization, these specific endpoints fail to mask the client secret when accessed by a user with the realm-management:view-clients role. An authenticated attacker with this role can retrieve the cleartext secret of any confidential client using the client-secret authenticator. Successful exploitation allows the attacker to obtain a client-credentials access token and exercise the target client's service account permissions. This issue represents an incomplete fix for CVE-2026-89298.