DeutschShown in its original language — a full translation is planned for a future version.
Keycloak: Mehrere Schwachstellen
view advisory published 2026-05-27
Ein Angreifer kann mehrere Schwachstellen in Keycloak ausnutzen, um seine Privilegien zu erhöhen, um Informationen offenzulegen, um Sicherheitsvorkehrungen zu umgehen und um einen Denial of Service Angriff durchzuführen.
01
describes (12)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-9803US | — | — | ||
A flaw was found in Keycloak's ClientRegistrationAuth component. A remote unauthenticated attacker can exploit this vulnerability by sending a specially crafted POST request with a… | ||||
| CVE-2026-9802US | — | — | ||
A flaw was found in Keycloak. When revokeRefreshToken=true is enabled and persistent session storage is in use, a server restart can reset internal timing mechanisms. This allows a… | ||||
| CVE-2026-9801US | — | — | ||
A flaw was found in Keycloak. A remote attacker with high privileges, such as a realm administrator configuring a malicious Lightweight Directory Access Protocol (LDAP) server or a… | ||||
| CVE-2026-9798US | — | — | ||
A flaw was found in Keycloak, an open-source identity and access management solution. When a user account is temporarily locked due to repeated failed login attempts, an attacker w… | ||||
| CVE-2026-9796US | — | — | ||
A flaw was found in Keycloak. An authenticated administrator with the `manage-clients` role can exploit a Time-of-check to time-of-use (TOCTOU) vulnerability in the name-based admi… | ||||
| CVE-2026-9795US | — | — | ||
A flaw was found in Keycloak's Fine-Grained Admin Permissions (FGAPv2) feature. An administrator with limited client management permissions can exploit this vulnerability to assign… | ||||
| CVE-2026-9794US | — | Exploit | ||
A flaw was found in Keycloak. A remote, unauthenticated attacker can exploit this vulnerability by sending specially crafted SOAP requests to the SAML ECP (Security Assertion Marku… | ||||
| CVE-2026-9793US | high7.5 | — | ||
A flaw was found in Keycloak. When a JSON Web Encryption (JWE) encrypted request object is submitted, Keycloak may incorrectly process unsigned claims if the decrypted content is r… | ||||
| CVE-2026-9792US | — | — | ||
A flaw was found in Keycloak's Client Policies, specifically within the `org.keycloak.protocol.oidc` component. When certain condition providers (client-type, client-roles, client-… | ||||
| CVE-2026-9791US | —OT elevated | — | ||
A flaw was found in Keycloak. An authenticated user with existing organization membership can exploit this flaw by accessing user-facing APIs, such as the account API or by request… | ||||
| CVE-2026-9704US | high8.8 | — | ||
A flaw was found in Keycloak. An authenticated user with low privileges can exploit this vulnerability by sending an oversized subject_token JSON Web Token (JWT) to the TokenEndpoi… | ||||
| CVE-2026-9689US | — | — | ||
A flaw was found in Keycloak, an open-source identity and access management solution. When a client application is configured to accept broad redirect Uniform Resource Identifiers… | ||||
02
references
External citations — patches, advisories, analysis.
- Red Hat Security Advisory RHSA-2026:25097 vom 2026-06-10external
- Red Hat Security Advisory RHSA-2026:25098 vom 2026-06-10external
- Red Hat Security Advisory RHSA-2026:30049 vom 2026-06-25external
- Red Hat Security Advisory RHSA-2026:30050 vom 2026-06-25external
- Red Hat Security Advisory RHSA-2026:30083 vom 2026-06-25external
- Red Hat Security Advisory RHSA-2026:30084 vom 2026-06-25external
- Red Hat Security Advisory RHSA-2026:50846 vom 2026-08-05external
- Red Hat Security Advisory RHSA-2026:50847 vom 2026-08-05external
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan