SB2026091059 - Multiple vulnerabilities in Keycloak

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026091059

SB2026091059 - Multiple vulnerabilities in Keycloak

Published: September 10, 2026

Security Bulletin ID SB2026091059
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 4
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

Medium 50% Low 50%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 4 vulnerabilities.


1) Improper Verification of Cryptographic Signature (CVE-ID: CVE-2026-1529)

CWE-ID: CWE-347 - Improper Verification of Cryptographic Signature

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to gain unauthorized access to an organization.

The vulnerability exists due to improper verification of cryptographic signatures in Keycloak invitation token validation when processing a modified invitation token JSON Web Token payload. A remote user can modify the organization ID and target email in a legitimate invitation token to gain unauthorized access to an organization.


2) Improperly implemented security check for standard (CVE-ID: CVE-2026-1486)

CWE-ID: CWE-358 - Improperly Implemented Security Check for Standard

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to obtain valid access tokens.

The vulnerability exists due to an improperly implemented security check in the jwt-authorization-grant flow when processing JWT assertions from a disabled Identity Provider. A remote user can submit a valid JWT assertion signed with the disabled Identity Provider\'s signing key to obtain valid access tokens.

The issuer lookup mechanism does not filter Identity Provider configurations with isEnabled=false.


3) Incorrect Privilege Assignment (CVE-ID: CVE-2025-14778)

CWE-ID: CWE-266 - Incorrect Privilege Assignment

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to escalate privileges.

The vulnerability exists due to improper authorization in the UserManagedPermissionService (UMA Protection API) when updating or deleting UMA policies associated with multiple resources. A remote user can update a shared policy to modify authorization rules for resources owned by another user to escalate privileges.

Exploitation requires ownership of the first resource in the policy\'s resource list.


4) Incorrect authorization (CVE-ID: CVE-2026-1609)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to obtain authentication tokens.

The vulnerability exists due to improper authorization in the JWT Authorization Grant flow when requesting tokens for a disabled user. A remote user can use the JWT Authorization Grant flow to obtain authentication tokens.


Remediation

Install update from vendor's website.

References