SB2026091061 - Multiple vulnerabilities in Keycloak

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026091061

SB2026091061 - Multiple vulnerabilities in Keycloak

Published: September 10, 2026

Security Bulletin ID SB2026091061
CSH Severity
Low
Patch available
YES
Number of vulnerabilities 8
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 8 vulnerabilities.


1) Time-of-check Time-of-use (TOCTOU) Race Condition (CVE-ID: CVE-2026-1035)

CWE-ID: CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition

CVSSv4: 2.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to bypass single-use refresh token enforcement.

The vulnerability exists due to a time-of-check time-of-use race condition in the TokenManager class during refresh token processing when strict refresh token rotation is enabled. A remote user can send concurrent refresh requests using the same refresh token to bypass single-use refresh token enforcement.


2) Authorization bypass through user-controlled key (CVE-ID: CVE-2025-14777)

CWE-ID: CWE-639 - Authorization Bypass Through User-Controlled Key

CVSSv4: 7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to modify or delete authorization resources belonging to another client.

The vulnerability exists due to improper access control in the ResourceSetService and PermissionTicketService admin API endpoints when handling authorization resource management requests. A remote privileged user can supply a valid resource ID belonging to another client to modify or delete its resources.

Exploitation is limited to resources within the same realm.


3) Improper access control (CVE-ID: CVE-2025-14082)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose sensitive role metadata.

The vulnerability exists due to improper access control in the Keycloak Admin REST API /admin/realms/{realm}/roles endpoint when handling requests to retrieve role metadata. A remote privileged user can send a request to the endpoint to disclose sensitive role metadata.


4) Exposure of Private Information ('Privacy Violation') (CVE-ID: CVE-2026-3911)

CWE-ID: CWE-359 - Exposure of Private Information ('Privacy Violation')

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose sensitive user information.

The vulnerability exists due to improper access control in the UserResource component when accessing a specific administrative endpoint. A remote privileged user can retrieve user attributes configured to be hidden to disclose sensitive user information.

The user must have the view-users role.


5) Server-Side Request Forgery (SSRF) (CVE-ID: CVE-2026-1180)

CWE-ID: CWE-918 - Server-Side Request Forgery (SSRF)

CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to perform blind server-side request forgery.

The vulnerability exists due to improper handling of jwks_uri in Keycloak OIDC Dynamic Client Registration when processing dynamic client registration requests. A remote attacker can provide a jwks_uri value to perform blind server-side request forgery.


6) Improper privilege management (CVE-ID: CVE-2026-3121)

CWE-ID: CWE-269 - Improper Privilege Management

CVSSv4: 8.5 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to escalate privileges.

The vulnerability exists due to improper privilege management in realm-level Admin Permissions when Admin Permissions are enabled at the realm level. A remote privileged user can use the manage-clients permission to escalate privileges.


7) Incorrect authorization (CVE-ID: CVE-2026-3190)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose permission ticket information.

The vulnerability exists due to improper role enforcement in the UMA 2.0 Protection API when handling requests using a token issued for a resource server client. A remote user can enumerate permission tickets to disclose permission ticket information.

The token does not need the uma_protection role.


8) Incorrect authorization (CVE-ID: CVE-2026-2366)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose user organization membership information.

The vulnerability exists due to incorrect authorization in the organizations feature when handling organization membership queries. A remote user can use an unprivileged token to enumerate user organization memberships to disclose user organization membership information.


Remediation

Install update from vendor's website.

References