SB2026091120 - Multiple vulnerabilities in Red Hat build of Keycloak
Published: September 11, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 5 vulnerabilities.
1) Improper isolation or compartmentalization (CVE-ID: CVE-2026-4325)
CWE-ID: CWE-653 - Improper isolation or compartmentalization
CVSSv4: 5.6 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to gain unauthorized access to accounts.
The vulnerability exists due to improper type and namespace isolation in the SingleUseObjectProvider when handling single-use entries. A remote attacker can delete arbitrary single-use entries to replay consumed action tokens.
User interaction is required.
2) Open redirect (CVE-ID: CVE-2026-3872)
CWE-ID: CWE-601 - URL Redirection to Untrusted Site ('Open Redirect')
CVSSv4: 6.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to disclose sensitive information.
The vulnerability exists due to improper redirect URI validation in the OIDC authorization endpoint when processing redirect URIs containing a ..;/ path traversal sequence and using a wildcard allowed path. A remote user can control another path on the same web server and bypass the allowed redirect URI path to disclose sensitive information.
User interaction is required.
3) Improper isolation or compartmentalization (CVE-ID: CVE-2026-4282)
CWE-ID: CWE-653 - Improper isolation or compartmentalization
CVSSv4: 9.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to escalate privileges.
The vulnerability exists due to improper isolation or compartmentalization in the SingleUseObjectProvider global key-value store when handling authorization codes. A remote attacker can forge authorization codes to escalate privileges.
Successful exploitation can result in the creation of admin-capable access tokens.
4) Excessive Platform Resource Consumption within a Loop (CVE-ID: CVE-2026-4634)
CWE-ID: CWE-1050 - Excessive Platform Resource Consumption within a Loop
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to excessive platform resource consumption within a loop in the OpenID Connect token endpoint when processing a specially crafted POST request with an excessively long scope parameter. A remote attacker can send a specially crafted POST request with an excessively long scope parameter to cause a denial of service.
5) Incorrect Behavior Order: Authorization Before Parsing and Canonicalization (CVE-ID: CVE-2026-4636)
CWE-ID: CWE-551 - Incorrect Behavior Order: Authorization Before Parsing and Canonicalization
CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to gain unauthorized permissions to victim-owned resources.
The vulnerability exists due to authorization before parsing and canonicalization in Keycloak User-Managed Access policy validation when creating a policy with resource identifiers owned by other users. A remote user can include victim-owned resource identifiers in a policy creation request for an attacker-owned resource to gain unauthorized permissions to victim-owned resources.
The user must have the uma_protection role. Successful exploitation can enable acquisition of a Requesting Party Token.
Remediation
Install update from vendor's website.