SB2026091122 - Multiple vulnerabilities in Red Hat build of Keycloak 26.6
Published: September 11, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 14 vulnerabilities.
1) Missing Authorization (CVE-ID: CVE-2026-9088)
CWE-ID: CWE-862 - Missing Authorization
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to disclose group member information.
The vulnerability exists due to improper access control in the Group Members Endpoint when handling group member requests. A remote user can send a group member request to disclose group member information.
2) Improper Validation of Specified Quantity in Input (CVE-ID: CVE-2026-9704)
CWE-ID: CWE-1284 - Improper Validation of Specified Quantity in Input
CVSSv4: 7.6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to escalate privileges.
The vulnerability exists due to improper validation of specified quantity in input in the TokenEndpoint when processing an oversized subject_token JSON Web Token (JWT). A remote user can send an oversized subject_token JWT to gain the permissions of the client\'s service account and escalate privileges.
3) Improper Validation of Specified Quantity in Input (CVE-ID: CVE-2026-9801)
CWE-ID: CWE-1284 - Improper Validation of Specified Quantity in Input
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to cause a denial of service.
The vulnerability exists due to improper validation of specified quantity in input in the LDAP password policy response handling when processing a password authentication request. A remote privileged user can send a malformed LDAP password policy response to cause a denial of service.
The error terminates the Keycloak Java Virtual Machine and disrupts all realms on the affected node.
4) Out-of-bounds read (CVE-ID: CVE-2026-9803)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to an out-of-bounds read in Keycloak\'s ClientRegistrationAuth component when processing a specially crafted POST request with a malformed Authorization: Bearer header at a client registration endpoint. A remote attacker can send a specially crafted POST request with a malformed Authorization: Bearer header to cause a denial of service.
The request can trigger an ArrayIndexOutOfBoundsException and an HTTP 500 error.
5) Incorrect authorization (CVE-ID: CVE-2026-9791)
CWE-ID: CWE-863 - Incorrect Authorization
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to disclose organization metadata.
The vulnerability exists due to incorrect authorization in Keycloak organization metadata handling when accessing user-facing APIs or requesting an OpenID Connect token with the organization scope. A remote user can access the account API or request an OpenID Connect token with the organization scope to disclose organization metadata.
The issue affects users with existing organization membership after the Organizations feature has been disabled, and the disclosed metadata may lead to incorrect authorization decisions by resource servers.
6) Information Exposure Through an Error Message (CVE-ID: CVE-2026-9794)
CWE-ID: CWE-209 - Information Exposure Through an Error Message
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to disclose client protocol information.
The vulnerability exists due to generation of error messages containing sensitive information in the SAML ECP endpoint when handling specially crafted SOAP requests with varying client IDs. A remote attacker can observe distinct faultstrings in responses to determine a client\'s protocol type and disclose client protocol information.
7) Insufficient Session Expiration (CVE-ID: CVE-2026-9802)
CWE-ID: CWE-613 - Insufficient Session Expiration
CVSSv4: 7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to gain unauthorized access to a victim\'s account.
The vulnerability exists due to insufficient session expiration in Keycloak persistent session handling when revokeRefreshToken=true is enabled, persistent session storage is in use, and the server restarts. A remote attacker can replay a previously captured and revoked refresh token to gain unauthorized access to a victim\'s account.
User interaction is required.
8) Authorization bypass through user-controlled key (CVE-ID: CVE-2026-9087)
CWE-ID: CWE-639 - Authorization Bypass Through User-Controlled Key
CVSSv4: 7.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to compromise a victim\'s local account.
The vulnerability exists due to insufficient verification proof scoping in the cross-session verification proof mechanism when linking identity provider accounts. A remote user can use a verification proof for a victim\'s local account to link a second upstream account on the same identity provider and compromise a victim\'s local account.
User interaction is required.
9) Improper Handling of Insufficient Permissions or Privileges (CVE-ID: CVE-2026-9792)
CWE-ID: CWE-280 - Improper Handling of Insufficient Permissions or Privileges
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to obtain tokens through a Resource Owner Password Credentials grant.
The vulnerability exists due to improper handling of insufficient permissions or privileges in Keycloak Client Policies within the org.keycloak.protocol.oidc component when processing Resource Owner Password Credentials grant requests with certain condition providers configured. A remote attacker can submit a Resource Owner Password Credentials grant request to obtain tokens through a Resource Owner Password Credentials grant.
Affected condition providers include client-type, client-roles, client-attributes, and client-scopes.
10) Use of Client-Side Authentication (CVE-ID: CVE-2026-8830)
CWE-ID: CWE-603 - Use of Client-Side Authentication
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to bypass configured WebAuthn policies during credential registration.
The vulnerability exists due to use of client-side authentication in the server-side processAction() when registering a WebAuthn credential. A remote user can manipulate client-side JavaScript to create a credential with parameters that do not match the realm\'s configured WebAuthn policies.
11) Direct Request ('Forced Browsing') (CVE-ID: CVE-2026-7500)
CWE-ID: CWE-425 - Direct Request ('Forced Browsing')
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass access restrictions.
The vulnerability exists due to improper access control in Keycloak services when directly requesting restricted resources. A remote attacker can send a direct request to bypass access restrictions.
12) Incorrect Implementation of Authentication Algorithm (CVE-ID: CVE-2026-8922)
CWE-ID: CWE-303 - Incorrect Implementation of Authentication Algorithm
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to gain unauthorized access.
The vulnerability exists due to an incorrect implementation of an authentication algorithm in the OpenID Connect introspection feature when both realm-level and client-level notBefore revocation policies are configured. A remote user can submit a token that should have been revoked for introspection to gain unauthorized access.
13) Input validation error (CVE-ID: CVE-2026-37977)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to disclose sensitive information.
The vulnerability exists due to improper input validation in CORS header handling when processing JWT azp claims. A remote user can provide a JWT with a crafted azp claim to disclose sensitive information.
14) Server-Side Request Forgery (SSRF) (CVE-ID: CVE-2026-4874)
CWE-ID: CWE-918 - Server-Side Request Forgery (SSRF)
CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to perform server-side request forgery.
The vulnerability exists due to improper control of outbound requests in the OIDC token endpoint when manipulating token endpoint configuration. A remote attacker can manipulate the OIDC token endpoint to perform server-side request forgery.
Remediation
Install update from vendor's website.