DeutschShown in its original language — a full translation is planned for a future version.
Keycloak: Mehrere Schwachstellen
view advisory published 2026-05-19
Ein Angreifer kann mehrere Schwachstellen in Keycloak ausnutzen, um Informationen offenzulegen, Daten zu manipulieren, Sicherheitsvorkehrungen zu umgehen und einen Denial of Service zu verursachen.
01
describes (9)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-7571US | — | — | ||
A flaw was found in Keycloak. A low-privilege user, with knowledge of user credentials and client ID, can bypass a security control intended to disable the implicit flow in OpenID… | ||||
| CVE-2026-7507US | — | — | ||
A session fixation vulnerability was found in Keycloak's login-actions endpoints. An unauthenticated attacker could exploit this flaw by pre-creating an authentication session and… | ||||
| CVE-2026-7504US | — | — | ||
A flaw was found in Keycloak's URL validation logic during redirect operations. By crafting a malicious request, an attacker could bypass validation to redirect users to unauthoriz… | ||||
| CVE-2026-7307US | — | — | ||
A flaw was found in Keycloak. A remote, unauthenticated attacker can send a specially crafted XML input to the Security Assertion Markup Language (SAML) endpoint. This malicious in… | ||||
| CVE-2026-4630US | — | — | ||
A flaw was found in Keycloak. An authenticated client could exploit an Insecure Direct Object Reference (IDOR) vulnerability in the Authorization Services Protection API endpoint.… | ||||
| CVE-2026-37982US | —OT elevated | — | ||
A flaw was found in Keycloak. This authentication vulnerability allows a remote attacker to replay `ExecuteActionsActionToken` tokens within Keycloak's WebAuthn (Web Authentication… | ||||
| CVE-2026-37981US | — | — | ||
A flaw was found in Keycloak. A broken access control vulnerability in the Account Resources user lookup endpoint allows a remote authenticated user, who owns at least one User-Man… | ||||
| CVE-2026-37979US | — | — | ||
A flaw was found in Keycloak. This access control vulnerability in Keycloak's OpenID Connect (OIDC) token introspection endpoint allows a confidential client to bypass audience res… | ||||
| CVE-2026-37978US | — | — | ||
A flaw was found in Keycloak. A low-privilege administrator with the 'view-clients' role can exploit this by invoking the 'evaluate-scopes' Admin API endpoints with an arbitrary us… | ||||
02
references
External citations — patches, advisories, analysis.
- Red Hat Security Advisory RHSA-2026:19594 vom 2026-05-20external
- Red Hat Security Advisory RHSA-2026:19595 vom 2026-05-20external
- Red Hat Security Advisory RHSA-2026:19596 vom 2026-05-20external
- Red Hat Security Advisory RHSA-2026:19597 vom 2026-05-20external
- WID-SEC-W-2026-1612 - CSAF Versionself
- WID-SEC-2026-1612 - Portal Versionself
- Keycloak 26.6.2 release vom 2026-05-19external
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan