Keycloak has a Time-of-check Time-of-use (TOCTOU) Race Condition
A flaw was found in Keycloak. An authenticated administrator with the `manage-clients` role can exploit a Time-of-check to time-of-use (TOCTOU) vulnerability in the name-based admin role checks. This allows the attacker to escalate their privileges to `realm-admin` for all users within the realm, granting them extensive control over the system. The composite role relationship persists even after the attacker's own permissions are revoked and across system reboots.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-9796US | — | — | ||
A flaw was found in Keycloak. An authenticated administrator with the `manage-clients` role can exploit a Time-of-check to time-of-use (TOCTOU) vulnerability in the name-based admi… | ||||
02
references
External citations — patches, advisories, analysis.
- https://access.redhat.com/errata/RHSA-2026:56523WEB
- https://access.redhat.com/errata/RHSA-2026:56524WEB
- https://access.redhat.com/security/cve/CVE-2026-9796WEB
- https://bugzilla.redhat.com/show_bug.cgi?id=2482464WEB
- https://github.com/keycloak/keycloakPACKAGE
- https://github.com/keycloak/keycloak/commit/39cb8de54c8517efeda4baa8bc314fd40e9c6934WEB
- https://github.com/keycloak/keycloak/issues/49427WEB
- https://github.com/keycloak/keycloak/pull/49624WEB
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan