Red Hat Build of Keycloak Text-only
Approved changes feed: RSS · Atom
cpe:2.3:a:redhat:build_of_keycloak:-:*:*:*:text-only:*:*:*
part: a version: - update: *
| Vendor | Redhat (e942785a-ca89-506e-bd99-50782639cde3) |
|---|---|
| Product | Build Of Keycloak (d6fb9030-f202-5ef5-8cdf-d5845602e058) |
| Edition | * |
| Language | * |
| Software edition | text-only |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from NVD CPE 2.0 feed |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-4636 |
vulnerable | 2026-06-08 08:05:13.629991 |
Keycloak: keycloak: uma policy bypass allows authenticated users to gain unauthorized access to victim-owned resources.
HIGH (8.1)
A flaw was found in Keycloak. An authenticated user with the uma_protection role can bypass User-Managed Access (UMA) policy validation. This allows the attacker to include resource identifiers owned by other users in a policy creation request, even if the URL path specifies an attacker-owned resource. Consequently, the attacker gains unauthorized permissions to victim-owned resources, enabling them to obtain a Requesting Party Token (RPT) and access sensitive information or perform unauthorized actions.
Published: 2026-04-02T12:45:01.841Z
Updated: 2026-07-15T00:50:31.767Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-4634 |
vulnerable | 2026-06-08 08:05:13.629137 |
Keycloak: keycloak: denial of service via excessive processing of openid connect scope parameters
HIGH (7.5)
A flaw was found in Keycloak. An unauthenticated attacker can exploit this vulnerability by sending a specially crafted POST request with an excessively long scope parameter to the OpenID Connect (OIDC) token endpoint. This leads to high resource consumption and prolonged processing times, ultimately resulting in a Denial of Service (DoS) for the Keycloak server.
Published: 2026-04-02T12:44:53.424Z
Updated: 2026-07-15T00:50:36.563Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-4325 |
vulnerable | 2026-06-08 08:05:13.235611 |
Keycloak: keycloak: replay of action tokens via improper handling of single-use entries
MEDIUM (5.3)
A flaw was found in Keycloak. The SingleUseObjectProvider, a global key-value store, lacks proper type and namespace isolation. This vulnerability allows an attacker to delete arbitrary single-use entries, which can enable the replay of consumed action tokens, such as password reset links. This could lead to unauthorized access or account compromise.
Published: 2026-04-02T12:44:52.997Z
Updated: 2026-04-07T11:27:36.605Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-4282 |
vulnerable | 2026-06-08 08:05:13.128368 |
Keycloak: keycloak: privilege escalation via forged authorization codes due to singleuseobjectprovider isolation flaw
HIGH (7.4)
A flaw was found in Keycloak. The SingleUseObjectProvider, a global key-value store, lacks proper type and namespace isolation. This vulnerability allows an unauthenticated attacker to forge authorization codes. Successful exploitation can lead to the creation of admin-capable access tokens, resulting in privilege escalation.
Published: 2026-04-02T12:44:52.941Z
Updated: 2026-07-15T00:56:46.658Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-3911 |
vulnerable | 2026-06-08 08:01:19.652903 |
Org.keycloak.services.resources.admin.userresource: keycloak: information disclosure of disabled user attributes via administrative endpoint
LOW (2.7)
A flaw was found in Keycloak. An authenticated user with the view-users role could exploit a vulnerability in the UserResource component. By accessing a specific administrative endpoint, this user could improperly retrieve user attributes that were configured to be hidden. This unauthorized information disclosure could expose sensitive user data.
Published: 2026-03-11T05:36:43.743Z
Updated: 2026-04-02T16:47:22.731Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-3872 |
vulnerable | 2026-06-08 08:01:19.590554 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-3047 |
vulnerable | 2026-06-08 08:01:17.436886 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-3009 |
vulnerable | 2026-06-08 08:01:17.307984 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-0871 |
vulnerable | 2026-06-08 07:47:13.399693 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-12150 |
vulnerable | 2026-06-08 07:04:29.761771 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-8883 |
vulnerable | 2026-06-08 07:00:25.926834 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-1132 |
vulnerable | 2026-06-08 06:25:39.327202 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-6787 |
vulnerable | 2026-06-08 06:21:55.832079 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.