Build Of Keycloak
Approved changes feed: RSS · Atom
cpe:2.3:a:redhat:build_of_keycloak:26.2.15:*:*:*:text-only:*:*:*
part: a version: 26.2.15 update: *
| Vendor | Redhat (e942785a-ca89-506e-bd99-50782639cde3) |
|---|---|
| Product | Build Of Keycloak (d6fb9030-f202-5ef5-8cdf-d5845602e058) |
| Edition | * |
| Language | * |
| Software edition | text-only |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-4636 |
vulnerable | 2026-06-08 08:05:13.630169 |
Keycloak: keycloak: uma policy bypass allows authenticated users to gain unauthorized access to victim-owned resources.
HIGH (8.1)
A flaw was found in Keycloak. An authenticated user with the uma_protection role can bypass User-Managed Access (UMA) policy validation. This allows the attacker to include resource identifiers owned by other users in a policy creation request, even if the URL path specifies an attacker-owned resource. Consequently, the attacker gains unauthorized permissions to victim-owned resources, enabling them to obtain a Requesting Party Token (RPT) and access sensitive information or perform unauthorized actions.
Published: 2026-04-02T12:45:01.841Z
Updated: 2026-07-15T00:50:31.767Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-4634 |
vulnerable | 2026-06-08 08:05:13.629378 |
Keycloak: keycloak: denial of service via excessive processing of openid connect scope parameters
HIGH (7.5)
A flaw was found in Keycloak. An unauthenticated attacker can exploit this vulnerability by sending a specially crafted POST request with an excessively long scope parameter to the OpenID Connect (OIDC) token endpoint. This leads to high resource consumption and prolonged processing times, ultimately resulting in a Denial of Service (DoS) for the Keycloak server.
Published: 2026-04-02T12:44:53.424Z
Updated: 2026-07-15T00:50:36.563Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-4325 |
vulnerable | 2026-06-08 08:05:13.235883 |
Keycloak: keycloak: replay of action tokens via improper handling of single-use entries
MEDIUM (5.3)
A flaw was found in Keycloak. The SingleUseObjectProvider, a global key-value store, lacks proper type and namespace isolation. This vulnerability allows an attacker to delete arbitrary single-use entries, which can enable the replay of consumed action tokens, such as password reset links. This could lead to unauthorized access or account compromise.
Published: 2026-04-02T12:44:52.997Z
Updated: 2026-04-07T11:27:36.605Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-4282 |
vulnerable | 2026-06-08 08:05:13.129923 |
Keycloak: keycloak: privilege escalation via forged authorization codes due to singleuseobjectprovider isolation flaw
HIGH (7.4)
A flaw was found in Keycloak. The SingleUseObjectProvider, a global key-value store, lacks proper type and namespace isolation. This vulnerability allows an unauthenticated attacker to forge authorization codes. Successful exploitation can lead to the creation of admin-capable access tokens, resulting in privilege escalation.
Published: 2026-04-02T12:44:52.941Z
Updated: 2026-07-15T00:56:46.658Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-3872 |
vulnerable | 2026-06-08 08:01:19.597182 |
Keycloak: keycloak: information disclosure due to redirect_uri validation bypass
HIGH (7.3)
A flaw was found in Keycloak. This issue allows an attacker, who controls another path on the same web server, to bypass the allowed path in redirect Uniform Resource Identifiers (URIs) that use a wildcard. A successful attack may lead to the theft of an access token, resulting in information disclosure.
Published: 2026-04-02T12:37:30.633Z
Updated: 2026-07-15T01:02:22.823Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.