SB2026091075 - Multiple vulnerabilities in Red Hat build of Keycloak 26.4
Published: September 10, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 9 vulnerabilities.
1) Improper Validation of Syntactic Correctness of Input (CVE-ID: CVE-2026-7307)
CWE-ID: CWE-1286 - Improper Validation of Syntactic Correctness of Input
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to improper validation of syntactic correctness of input in the SAML endpoint when processing specially crafted XML input. A remote attacker can send a specially crafted XML input to cause a denial of service.
The malicious input can cause high CPU usage and worker thread starvation, making the server unavailable.
2) Authorization bypass through user-controlled key (CVE-ID: CVE-2026-37978)
CWE-ID: CWE-639 - Authorization Bypass Through User-Controlled Key
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to disclose personally identifiable information.
The vulnerability exists due to authorization bypass through a user-controlled key in the evaluate-scopes Admin API endpoints when invoking the endpoints with an arbitrary user ID parameter. A remote privileged user can submit an arbitrary user ID to view user identities and authorizations across the realm.
The issue affects administrators assigned the view-clients role.
3) Authentication Bypass by Capture-replay (CVE-ID: CVE-2026-37982)
CWE-ID: CWE-294 - Authentication Bypass by Capture-replay
CVSSv4: 7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to take over accounts.
The vulnerability exists due to authentication bypass by capture-replay in Keycloak\'s WebAuthn flow when processing an intercepted execute-actions email link. A remote attacker can replay an ExecuteActionsActionToken token and register an authenticator to a victim\'s account to take over accounts.
User interaction is required to access an execute-actions email link.
4) Improper access control (CVE-ID: CVE-2026-37979)
CWE-ID: CWE-284 - Improper Access Control
CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to disclose sensitive token claims.
The vulnerability exists due to improper access control in Keycloak\'s OpenID Connect token introspection endpoint when processing introspection requests from confidential clients. A remote user can use valid confidential-client credentials to bypass audience restrictions and disclose sensitive token claims.
Lightweight access tokens are affected.
5) External Control of Assumed-Immutable Web Parameter (CVE-ID: CVE-2026-7571)
CWE-ID: CWE-472 - External Control of Assumed-Immutable Web Parameter
CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to obtain access tokens and disclose sensitive information.
The vulnerability exists due to external control of assumed-immutable web parameters in the OIDC client data handling during session restart when manipulating client data. A remote user can manipulate client data during a session restart to bypass the control that disables the implicit flow and obtain an access token.
Exploitation requires knowledge of user credentials and a client ID. Access tokens may be exposed in server logs, proxy logs, and HTTP Referrer headers.
6) Authentication Bypass by Spoofing (CVE-ID: CVE-2026-7507)
CWE-ID: CWE-290 - Authentication Bypass by Spoofing
CVSSv4: 7.1 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to take over accounts.
The vulnerability exists due to authentication bypass by spoofing in Keycloak login-actions endpoints when processing a crafted link to the /login-actions/restart endpoint. A remote attacker can pre-create an authentication session and trick a victim into visiting the crafted link to take over accounts.
User interaction is required to visit the crafted link.
7) Open redirect (CVE-ID: CVE-2026-7504)
CWE-ID: CWE-601 - URL Redirection to Untrusted Site ('Open Redirect')
CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to redirect users to unauthorized URLs.
The vulnerability exists due to improper URL validation in Keycloak\'s redirect URI validation logic when processing a malicious redirect URL containing multiple @ characters in the user-info component. A remote attacker can send a crafted redirect request to redirect users to unauthorized URLs.
User interaction is required, and only clients configured with a wildcard (*) in the Valid Redirect URIs field are affected.
8) Insufficient Granularity of Access Control (CVE-ID: CVE-2026-37981)
CWE-ID: CWE-1220 - Insufficient Granularity of Access Control
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to disclose personally identifiable information for realm users.
The vulnerability exists due to insufficient granularity of access control in the Keycloak Account Resources user lookup endpoint when handling crafted requests containing arbitrary usernames or email values. A remote user can send crafted requests to enumerate realm users and retrieve full profile objects for unrelated users to disclose personally identifiable information for realm users.
Exploitation requires ownership of at least one User-Managed Access (UMA) resource.
9) Authorization bypass through user-controlled key (CVE-ID: CVE-2026-4630)
CWE-ID: CWE-639 - Authorization Bypass Through User-Controlled Key
CVSSv4: 7.6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to disclose information and modify or delete data.
The vulnerability exists due to authorization bypass through a user-controlled key in the Authorization Services Protection API endpoint when handling requests that specify the UUID of a resource owned by another Resource Server in the same realm. A remote user can send GET, PUT, or DELETE requests using a known or obtained resource UUID to disclose information and modify or delete data.
Remediation
Install update from vendor's website.