SB2026090518 - Multiple vulnerabilities in Keycloak
Published: September 5, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 20 vulnerabilities.
1) Missing Authorization (CVE-ID: CVE-2026-18218)
CWE-ID: CWE-862 - Missing Authorization
CVSSv4: 2.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to retain access to user information and refresh sessions using previously issued tokens.
The vulnerability exists due to missing authorization in the TokenManager component when processing client-specific \"not-before\" token revocation policies. A remote user can continue using previously issued tokens after an administrator attempts to invalidate them to retain access to user information and refresh sessions.
The issue occurs when the security realm already has an older, non-zero revocation policy in place.
2) Missing Authorization (CVE-ID: CVE-2026-79652)
CWE-ID: CWE-862 - Missing Authorization
CVSSv4: 6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to obtain unauthorized access to a user account at a consent-gated client.
The vulnerability exists due to missing authorization in the JWT Bearer authorization grant implementation within the keycloak-services component when issuing access tokens through the JWT Bearer grant. A remote user can present valid client credentials and a trusted identity provider assertion to bypass the user-consent requirement and obtain unauthorized access to a user account at a consent-gated client.
3) Reliance on Untrusted Inputs in a Security Decision (CVE-ID: CVE-2026-16093)
CWE-ID: CWE-807 - Reliance on Untrusted Inputs in a Security Decision
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to bypass client authentication policy requirements.
The vulnerability exists due to reliance on untrusted inputs in a security decision in the Client Policies enforcement mechanism when processing client assertion headers. A remote user can provide a fake unsigned assertion header to bypass the policy requirements.
Exploitation requires valid client credentials.
4) Improper access control (CVE-ID: CVE-2026-16072)
CWE-ID: CWE-284 - Improper Access Control
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to add unauthorized members to an organization.
The vulnerability exists due to improper access control in the organization management component when creating invitations for non-existent email addresses and retrieving their secret registration links through the application programming interface. A remote privileged user can create an invitation and retrieve its secret registration link to add unauthorized members to an organization.
Exploitation requires permission to manage organizations.
5) Insufficient Granularity of Access Control (CVE-ID: CVE-2026-16108)
CWE-ID: CWE-1220 - Insufficient Granularity of Access Control
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to disclose sensitive information.
The vulnerability exists due to insufficient granularity of access control in the default-groups REST endpoint and realm representation when handling requests from delegated administrators with realm-viewing permissions. A remote user can access the names and identifiers of hidden default groups to disclose sensitive information.
6) Authorization bypass through user-controlled key (CVE-ID: CVE-2026-16105)
CWE-ID: CWE-639 - Authorization Bypass Through User-Controlled Key
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to disrupt administrative functions within a realm.
The vulnerability exists due to missing authorization in the RoleContainerResource component when managing composite roles through name-based admin REST API endpoints. A remote privileged user can remove essential child roles from built-in admin roles to disrupt administrative functions within a realm.
Exploitation requires manage-realm permissions.
7) Session Fixation (CVE-ID: CVE-2026-16089)
CWE-ID: CWE-384 - Session Fixation
CVSSv4: 5.8 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to obtain access tokens for a victim\'s identity.
The vulnerability exists due to improper binding of OAuth 2.0 authorization codes to clients in the keycloak-services component when redeeming an intercepted authorization code. A remote user can modify the intercepted code to redeem it using their own client to obtain access tokens for a victim\'s identity.
User interaction is required.
8) Improper Removal of Sensitive Information Before Storage or Transfer (CVE-ID: CVE-2026-16104)
CWE-ID: CWE-212 - Improper Removal of Sensitive Information Before Storage or Transfer
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to disclose third-party service credentials.
The vulnerability exists due to improper removal of sensitive information before transfer in the authentication configuration endpoint of the keycloak-services component when handling requests for configuration values. A remote user can request authentication configuration values to disclose third-party service credentials.
Exploitation requires an administrator account with view-only permissions, and exposed values may include reCAPTCHA secret keys.
9) Missing Authorization (CVE-ID: CVE-2026-16106)
CWE-ID: CWE-862 - Missing Authorization
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to remove privileged roles they are not authorized to manage.
The vulnerability exists due to missing authorization checks in the admin REST API when removing a child role from a composite role. A remote privileged user can remove a child role from a composite role to remove privileged roles they are not authorized to manage.
10) Authorization bypass through user-controlled key (CVE-ID: CVE-2026-17059)
CWE-ID: CWE-639 - Authorization Bypass Through User-Controlled Key
CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to disclose private user information.
The vulnerability exists due to improper access control in the role-users endpoint of the keycloak-services library when listing members of a role. A remote user can request role membership listings without permission to view the individual users to disclose private user information.
Disclosed information may include user names and email addresses.
11) Missing Authorization (CVE-ID: CVE-2026-18201)
CWE-ID: CWE-862 - Missing Authorization
CVSSv4: 7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to influence how users log into specific organizations.
The vulnerability exists due to missing authorization in the administrative API when linking a new identity provider to an organization. A remote privileged user can link a new identity provider to an organization without permission to manage that organization to influence how users log into specific organizations.
12) Improper validation of certificate with host mismatch (CVE-ID: CVE-2026-35563)
CWE-ID: CWE-297 - Improper Validation of Certificate with Host Mismatch
CVSSv4: 7.6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to impersonate an LDAP server and compromise the connection.
The vulnerability exists due to improper validation of certificate with host mismatch in the LDAP client implementation when establishing TLS-protected LDAP connections. A remote user can present a valid certificate for an unrelated host to impersonate an LDAP server and compromise the connection.
Exploitation requires man-in-the-middle capability on the network and a certificate trusted by the client\'s configured trust store.
13) Improper Validation of Consistency within Input (CVE-ID: CVE-2026-18209)
CWE-ID: CWE-1288 - Improper Validation of Consistency within Input
CVSSv4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to influence session handling or cause account confusion.
The vulnerability exists due to improper validation of consistency within input in the keycloak-services component when processing redirect URLs with wildcard redirect URIs. A remote attacker can inject duplicate security parameters into a login response to influence session handling or cause account confusion.
User interaction is required, and exploitation depends on a client application trusting injected data instead of security information from Keycloak.
14) Missing Authorization (CVE-ID: CVE-2026-18214)
CWE-ID: CWE-862 - Missing Authorization
CVSSv4: 7.6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to gain unauthorized access to the Keycloak realm.
The vulnerability exists due to missing authorization in the token exchange feature when exchanging a Google token. A remote user can exchange a valid Google token from an unapproved domain to gain unauthorized access to the Keycloak realm.
The issue applies to realms configured to restrict access to specific Google Workspace domains.
15) Missing Authorization (CVE-ID: CVE-2026-18571)
CWE-ID: CWE-862 - Missing Authorization
CVSSv4: 5.9 [CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to grant newly created users elevated privileges.
The vulnerability exists due to missing authorization in the user creation component when Fine-Grained Admin Permissions V2 is enabled. A remote privileged user can create users and add them to groups they are not authorized to manage to grant newly created users elevated privileges.
16) Incorrect authorization (CVE-ID: CVE-2026-18572)
CWE-ID: CWE-863 - Incorrect Authorization
CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to bypass time-based authorization restrictions.
The vulnerability exists due to incorrect authorization in Keycloak authorization services when processing authorization requests containing a user-supplied time value. A remote user can include a fake time value in an authorization request to bypass time-based authorization restrictions.
17) Missing Authorization (CVE-ID: CVE-2026-18573)
CWE-ID: CWE-862 - Missing Authorization
CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to bypass client authentication policies.
The vulnerability exists due to improper authorization in the keycloak-services component when updating a public client to a confidential client. A remote user can create a public client and update it to a confidential client with weaker authentication to bypass client authentication policies.
Exploitation requires client management permissions and realm client policies that enforce authentication requirements on confidential clients.
18) Missing Authorization (CVE-ID: CVE-2026-18570)
CWE-ID: CWE-862 - Missing Authorization
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to obtain tokens with unauthorized role mappings.
The vulnerability exists due to missing authorization in the full-scope-disabled client-policy executor within the keycloak-services component when processing client registration or configuration requests that omit the fullScopeAllowed field. A remote user can omit the fullScopeAllowed field when creating a client to obtain tokens with unauthorized role mappings.
19) Path traversal (CVE-ID: CVE-2026-19729)
CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to probe the filesystem.
The vulnerability exists due to improper limitation of a pathname in core relative path handling when processing a supplied relative path. A remote attacker can supply a crafted relative path to probe the filesystem.
20) Improper Authentication (CVE-ID: CVE-2026-18215)
CWE-ID: CWE-287 - Improper Authentication
CVSSv4: 7.6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to gain unauthorized access to the Keycloak realm.
The vulnerability exists due to improper authentication in the Microsoft identity provider tenant restriction handling when using the token exchange feature. A remote user can exchange a valid Microsoft token issued by a different organization to gain unauthorized access to the Keycloak realm.
The issue can potentially expose sensitive data or permit unauthorized actions.
Remediation
Install update from vendor's website.