Red Hat Build Of Keycloak
Approved changes feed: RSS · Atom
cpe:2.3:a:redhat:build_of_keycloak:-:*:*:*:-:*:*:*
part: a version: - update: *
| Vendor | Redhat (e942785a-ca89-506e-bd99-50782639cde3) |
|---|---|
| Product | Build Of Keycloak (d6fb9030-f202-5ef5-8cdf-d5845602e058) |
| Edition | * |
| Language | * |
| Software edition | - |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from NVD CPE 2.0 feed |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-9704 |
vulnerable | 2026-07-29 01:12:09.547058 |
Keycloak: keycloak: privilege escalation due to oversized subject_token jwt
MEDIUM (6.8)
A flaw was found in Keycloak. An authenticated user with low privileges can exploit this vulnerability by sending an oversized subject_token JSON Web Token (JWT) to the TokenEndpoint. When the token exceeds a 4000-character limit, it is silently dropped, causing the system to fall back to client credentials. This allows the user to gain the permissions of the client's service account, leading to privilege escalation.
Published: 2026-05-27T12:56:00.858Z
Updated: 2026-06-26T06:46:25.912Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-7500 |
vulnerable | 2026-06-08 08:08:57.305939 |
Org.keycloak.keycloak-services: improper access control on keycloak server when the account account api feature is disabled
MEDIUM (5.4)
When Keycloak is started with `--features-disabled=account,account-api`, the Account REST API is only partially disabled. Five endpoints under the versioned path `/account/v1alpha1` remain fully functional — including both read and write operations — because they lack the `checkAccountApiEnabled()` gate that correctly blocks four other endpoints in the same REST service class. The user needs to have permissions to use the API.
Published: 2026-04-30T14:53:09.192Z
Updated: 2026-06-26T06:46:16.467Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-4874 |
vulnerable | 2026-06-08 08:07:02.570335 |
Org.keycloak.protocol.oidc.grants: org.keycloak.services.managers: keycloak: server-side request forgery via oidc token endpoint manipulation
LOW (3.1)
A flaw was found in Keycloak. An authenticated attacker can perform Server-Side Request Forgery (SSRF) by manipulating the `client_session_host` parameter during refresh token requests. This occurs when a Keycloak client is configured to use the `backchannel.logout.url` with the `application.session.host` placeholder. Successful exploitation allows the attacker to make HTTP requests from the Keycloak server’s network context, potentially probing internal networks or internal APIs, leading to information disclosure.
Published: 2026-03-26T07:12:37.545Z
Updated: 2026-06-26T07:01:28.059Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-4633 |
vulnerable | 2026-06-08 08:05:13.628658 |
Keycloak: keycloak: user enumeration via differential error messages
LOW (3.7)
A flaw was found in Keycloak. A remote attacker can exploit differential error messages during the identity-first login flow when Organizations are enabled. This vulnerability allows an attacker to determine the existence of users, leading to information disclosure through user enumeration.
Published: 2026-03-23T10:53:35.655Z
Updated: 2026-04-01T14:38:10.321Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-4628 |
vulnerable | 2026-06-08 08:05:13.627378 |
Keycloak: org.keycloak.authorization: keycloak: unauthorized resource modification due to improper access control
MEDIUM (4.3)
A flaw was found in Keycloak. An improper Access Control vulnerability in Keycloak’s User-Managed Access (UMA) resource_set endpoint allows attackers with valid credentials to bypass the allowRemoteResourceManagement=false restriction. This occurs due to incomplete enforcement of access control checks on PUT operations to the resource_set endpoint. This issue enables unauthorized modification of protected resources, impacting data integrity.
Published: 2026-03-23T08:09:22.123Z
Updated: 2026-03-25T14:03:04.463Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-4366 |
vulnerable | 2026-06-08 08:05:13.288220 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-3190 |
vulnerable | 2026-06-08 08:01:18.054704 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-3121 |
vulnerable | 2026-06-08 08:01:17.886306 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-37977 |
vulnerable | 2026-06-08 08:01:16.040048 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-7784 |
vulnerable | 2026-06-08 07:45:18.222678 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.