SB2026090517 - Multiple vulnerabilities in Keycloak

Description

This security bulletin contains information about 16 vulnerabilities.

1) Authorization bypass through user-controlled key (CVE-ID: CVE-2026-9087)

CWE-ID: CWE-639 - Authorization Bypass Through User-Controlled Key

CVSSv4: 7.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to compromise a victim\'s local account.

The vulnerability exists due to insufficient verification proof scoping in the cross-session verification proof mechanism when linking identity provider accounts. A remote user can use a verification proof for a victim\'s local account to link a second upstream account on the same identity provider and compromise a victim\'s local account.

User interaction is required.

2) Missing Authorization (CVE-ID: CVE-2026-9088)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to disclose group member information.

The vulnerability exists due to improper access control in the Group Members Endpoint when handling group member requests. A remote user can send a group member request to disclose group member information.

3) Improper Validation of Specified Quantity in Input (CVE-ID: CVE-2026-9704)

CWE-ID: CWE-1284 - Improper Validation of Specified Quantity in Input

CVSSv4: 7.6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to escalate privileges.

The vulnerability exists due to improper validation of specified quantity in input in the TokenEndpoint when processing an oversized subject_token JSON Web Token (JWT). A remote user can send an oversized subject_token JWT to gain the permissions of the client\'s service account and escalate privileges.

4) Improper Validation of Specified Quantity in Input (CVE-ID: CVE-2026-9801)

CWE-ID: CWE-1284 - Improper Validation of Specified Quantity in Input

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to improper validation of specified quantity in input in the LDAP password policy response handling when processing a password authentication request. A remote privileged user can send a malformed LDAP password policy response to cause a denial of service.

The error terminates the Keycloak Java Virtual Machine and disrupts all realms on the affected node.

5) Incorrect authorization (CVE-ID: CVE-2026-9791)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to disclose organization metadata.

The vulnerability exists due to incorrect authorization in Keycloak organization metadata handling when accessing user-facing APIs or requesting an OpenID Connect token with the organization scope. A remote user can access the account API or request an OpenID Connect token with the organization scope to disclose organization metadata.

The issue affects users with existing organization membership after the Organizations feature has been disabled, and the disclosed metadata may lead to incorrect authorization decisions by resource servers.

6) Information Exposure Through an Error Message (CVE-ID: CVE-2026-9794)

CWE-ID: CWE-209 - Information Exposure Through an Error Message

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose client protocol information.

The vulnerability exists due to generation of error messages containing sensitive information in the SAML ECP endpoint when handling specially crafted SOAP requests with varying client IDs. A remote attacker can observe distinct faultstrings in responses to determine a client\'s protocol type and disclose client protocol information.

7) Insufficient Session Expiration (CVE-ID: CVE-2026-9802)

CWE-ID: CWE-613 - Insufficient Session Expiration

CVSSv4: 7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain unauthorized access to a victim\'s account.

The vulnerability exists due to insufficient session expiration in Keycloak persistent session handling when revokeRefreshToken=true is enabled, persistent session storage is in use, and the server restarts. A remote attacker can replay a previously captured and revoked refresh token to gain unauthorized access to a victim\'s account.

User interaction is required.

8) Resource exhaustion (CVE-ID: N/A)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper handling of malformed Authorization headers in ClientRegistrationAuth when processing client registration authentication requests. A remote attacker can send a malformed Authorization header to cause a denial of service.

This issue is an incomplete fix for CVE-2026-0707.

9) Use of Client-Side Authentication (CVE-ID: CVE-2026-8830)

CWE-ID: CWE-603 - Use of Client-Side Authentication

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to bypass configured WebAuthn policies during credential registration.

The vulnerability exists due to use of client-side authentication in the server-side processAction() when registering a WebAuthn credential. A remote user can manipulate client-side JavaScript to create a credential with parameters that do not match the realm\'s configured WebAuthn policies.

10) Incorrect Implementation of Authentication Algorithm (CVE-ID: CVE-2026-8922)

CWE-ID: CWE-303 - Incorrect Implementation of Authentication Algorithm

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to gain unauthorized access.

The vulnerability exists due to an incorrect implementation of an authentication algorithm in the OpenID Connect introspection feature when both realm-level and client-level notBefore revocation policies are configured. A remote user can submit a token that should have been revoked for introspection to gain unauthorized access.

11) Inconsistent interpretation of HTTP requests (CVE-ID: CVE-2026-42581)

CWE-ID: CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform request smuggling.

The vulnerability exists due to improper input validation in HttpObjectDecoder when processing HTTP/1.0 requests containing both Transfer-Encoding: chunked and Content-Length headers. A remote attacker can send a specially crafted HTTP/1.0 request to perform request smuggling.

Exploitation requires Netty to be deployed behind a downstream proxy or handler that trusts Content-Length over Transfer-Encoding.

12) Direct Request ('Forced Browsing') (CVE-ID: CVE-2026-7500)

CWE-ID: CWE-425 - Direct Request ('Forced Browsing')

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass access restrictions.

The vulnerability exists due to improper access control in Keycloak services when directly requesting restricted resources. A remote attacker can send a direct request to bypass access restrictions.

13) Input validation error (CVE-ID: CVE-2026-37977)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to improper input validation in CORS header handling when processing JWT azp claims. A remote user can provide a JWT with a crafted azp claim to disclose sensitive information.

14) Server-Side Request Forgery (SSRF) (CVE-ID: CVE-2026-4874)

CWE-ID: CWE-918 - Server-Side Request Forgery (SSRF)

CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform server-side request forgery.

The vulnerability exists due to improper control of outbound requests in the OIDC token endpoint when manipulating token endpoint configuration. A remote attacker can manipulate the OIDC token endpoint to perform server-side request forgery.

15) Code Injection (CVE-ID: CVE-2026-4800)

CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')

CVSSv4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to improper control of code generation in _.template when processing untrusted options.imports key names. A remote attacker can supply crafted imports key names to execute arbitrary code.

Code execution occurs at template compilation time. If Object.prototype has been polluted by another vector, inherited polluted keys can also be copied into the imports object and passed to Function().

16) Improper Handling of Insufficient Permissions or Privileges (CVE-ID: CVE-2026-9792)

CWE-ID: CWE-280 - Improper Handling of Insufficient Permissions or Privileges

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to obtain tokens through a Resource Owner Password Credentials grant.

The vulnerability exists due to improper handling of insufficient permissions or privileges in Keycloak Client Policies within the org.keycloak.protocol.oidc component when processing Resource Owner Password Credentials grant requests with certain condition providers configured. A remote attacker can submit a Resource Owner Password Credentials grant request to obtain tokens through a Resource Owner Password Credentials grant.

Affected condition providers include client-type, client-roles, client-attributes, and client-scopes.

Remediation

Install update from vendor's website.

References

• https://github.com/keycloak/keycloak/releases/tag/26.6.3