SB2026091128 - Multiple vulnerabilities in Red Hat build of Keycloak
Published: September 11, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 23 vulnerabilities.
1) Authorization bypass through user-controlled key (CVE-ID: CVE-2026-9099)
CWE-ID: CWE-639 - Authorization Bypass Through User-Controlled Key
CVSSv4: 7.4 [CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to escalate privileges and compromise administrative accounts.
The vulnerability exists due to improper access control in the GroupResource.addChild() endpoint within the Admin REST API when handling group reparenting requests. A remote privileged user can reparent a highly privileged group under a managed low-privilege group to escalate privileges and compromise administrative accounts.
Only instances with Fine-Grained Admin Permissions v2 enabled are vulnerable to the described privilege inheritance abuse.
2) Improper Verification of Cryptographic Signature (CVE-ID: CVE-2026-11800)
CWE-ID: CWE-347 - Improper Verification of Cryptographic Signature
CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to bypass signature verification and obtain unauthorized access tokens.
The vulnerability exists due to improper verification of cryptographic signature in the JWT Authorization Grant flow when processing forged JWT assertions. A remote user can forge an assertion to bypass signature verification and obtain unauthorized access tokens.
The issue can allow impersonation of any federated user linked to the affected identity provider.
3) Out-of-bounds read (CVE-ID: CVE-2026-9803)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to an out-of-bounds read in Keycloak\'s ClientRegistrationAuth component when processing a specially crafted POST request with a malformed Authorization: Bearer header at a client registration endpoint. A remote attacker can send a specially crafted POST request with a malformed Authorization: Bearer header to cause a denial of service.
The request can trigger an ArrayIndexOutOfBoundsException and an HTTP 500 error.
4) Server-Side Request Forgery (SSRF) (CVE-ID: CVE-2026-4874)
CWE-ID: CWE-918 - Server-Side Request Forgery (SSRF)
CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to perform server-side request forgery.
The vulnerability exists due to improper control of outbound requests in the OIDC token endpoint when manipulating token endpoint configuration. A remote attacker can manipulate the OIDC token endpoint to perform server-side request forgery.
5) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-6860)
CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to allocation of resources without limits or throttling in the server-side SNI SslContext cache when handling TLS connections with server name indication. A remote attacker can send TLS connections with distinct server name indications to cause a denial of service.
6) Direct Request ('Forced Browsing') (CVE-ID: CVE-2026-7500)
CWE-ID: CWE-425 - Direct Request ('Forced Browsing')
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass access restrictions.
The vulnerability exists due to improper access control in Keycloak services when directly requesting restricted resources. A remote attacker can send a direct request to bypass access restrictions.
7) Use of Client-Side Authentication (CVE-ID: CVE-2026-8830)
CWE-ID: CWE-603 - Use of Client-Side Authentication
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to bypass configured WebAuthn policies during credential registration.
The vulnerability exists due to use of client-side authentication in the server-side processAction() when registering a WebAuthn credential. A remote user can manipulate client-side JavaScript to create a credential with parameters that do not match the realm\'s configured WebAuthn policies.
8) Incorrect Implementation of Authentication Algorithm (CVE-ID: CVE-2026-8922)
CWE-ID: CWE-303 - Incorrect Implementation of Authentication Algorithm
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to gain unauthorized access.
The vulnerability exists due to an incorrect implementation of an authentication algorithm in the OpenID Connect introspection feature when both realm-level and client-level notBefore revocation policies are configured. A remote user can submit a token that should have been revoked for introspection to gain unauthorized access.
9) Path traversal (CVE-ID: CVE-2026-9083)
CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to disclose sensitive information.
The vulnerability exists due to path traversal in the key provider component creation keystore parameter when creating a key provider component. A remote privileged user can submit an arbitrary filesystem path as a keystore parameter to disclose sensitive information.
The issue allows probing arbitrary filesystem paths to determine which files exist and are readable by the Keycloak process.
10) Cross-site scripting (CVE-ID: CVE-2026-9086)
CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
The vulnerability allows a remote user to execute arbitrary code in the Keycloak origin.
The vulnerability exists due to cross-site scripting in client URI validation when processing a specially crafted redirect URI with a case-insensitive javascript: or data: scheme. A remote user can register a malicious client and supply a crafted link to execute arbitrary code in the Keycloak origin.
User interaction is required to click the crafted link, such as during the logout flow or in the Admin Console.
11) Authorization bypass through user-controlled key (CVE-ID: CVE-2026-9087)
CWE-ID: CWE-639 - Authorization Bypass Through User-Controlled Key
CVSSv4: 7.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to compromise a victim\'s local account.
The vulnerability exists due to insufficient verification proof scoping in the cross-session verification proof mechanism when linking identity provider accounts. A remote user can use a verification proof for a victim\'s local account to link a second upstream account on the same identity provider and compromise a victim\'s local account.
User interaction is required.
12) Missing Authorization (CVE-ID: CVE-2026-9088)
CWE-ID: CWE-862 - Missing Authorization
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to disclose group member information.
The vulnerability exists due to improper access control in the Group Members Endpoint when handling group member requests. A remote user can send a group member request to disclose group member information.
13) Insufficient Session Expiration (CVE-ID: CVE-2026-9705)
CWE-ID: CWE-613 - Insufficient Session Expiration
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to disclose sensitive information and compromise integrity.
The vulnerability exists due to insufficient session expiration in the client registration service when processing requests with a previously issued registration access token. A remote attacker can use a stale registration access token to re-enable a disabled client and reset its secret to disclose sensitive information and compromise integrity.
Exploitation requires possession of a previously issued registration access token for the client.
14) Input validation error (CVE-ID: CVE-2026-37977)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to disclose sensitive information.
The vulnerability exists due to improper input validation in CORS header handling when processing JWT azp claims. A remote user can provide a JWT with a crafted azp claim to disclose sensitive information.
15) Incorrect authorization (CVE-ID: CVE-2026-9791)
CWE-ID: CWE-863 - Incorrect Authorization
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to disclose organization metadata.
The vulnerability exists due to incorrect authorization in Keycloak organization metadata handling when accessing user-facing APIs or requesting an OpenID Connect token with the organization scope. A remote user can access the account API or request an OpenID Connect token with the organization scope to disclose organization metadata.
The issue affects users with existing organization membership after the Organizations feature has been disabled, and the disclosed metadata may lead to incorrect authorization decisions by resource servers.
16) Improper Handling of Insufficient Permissions or Privileges (CVE-ID: CVE-2026-9792)
CWE-ID: CWE-280 - Improper Handling of Insufficient Permissions or Privileges
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to obtain tokens through a Resource Owner Password Credentials grant.
The vulnerability exists due to improper handling of insufficient permissions or privileges in Keycloak Client Policies within the org.keycloak.protocol.oidc component when processing Resource Owner Password Credentials grant requests with certain condition providers configured. A remote attacker can submit a Resource Owner Password Credentials grant request to obtain tokens through a Resource Owner Password Credentials grant.
Affected condition providers include client-type, client-roles, client-attributes, and client-scopes.
17) Information Exposure Through an Error Message (CVE-ID: CVE-2026-9794)
CWE-ID: CWE-209 - Information Exposure Through an Error Message
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to disclose client protocol information.
The vulnerability exists due to generation of error messages containing sensitive information in the SAML ECP endpoint when handling specially crafted SOAP requests with varying client IDs. A remote attacker can observe distinct faultstrings in responses to determine a client\'s protocol type and disclose client protocol information.
18) Incorrect Privilege Assignment (CVE-ID: CVE-2026-9795)
CWE-ID: CWE-266 - Incorrect Privilege Assignment
CVSSv4: 7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to escalate privileges.
The vulnerability exists due to improper scope mapping enforcement in the Fine-Grained Admin Permissions (FGAPv2) feature when managing client scope mappings. A remote privileged user can assign arbitrary realm roles, including highly privileged roles, to a client's scope mapping to escalate privileges.
User interaction is required when a user accesses the modified client, causing the injected role to be projected into the authentication token.
19) Authorization bypass through user-controlled key (CVE-ID: CVE-2026-9799)
CWE-ID: CWE-639 - Authorization Bypass Through User-Controlled Key
CVSSv4: 4.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to disclose sensitive information or modify resources.
The vulnerability exists due to improper access control in org.keycloak.authorization when processing a permission request with a specific prefix. A remote user can use a granted User-Managed Access (UMA) permission ticket for one resource to bypass per-resource access control and disclose sensitive information or modify resources.
The issue affects typed resources with ownerManagedAccess enabled when the same resource server is configured in PERMISSIVE policy enforcement mode and no explicit policy protects the resource type. User interaction is required.
20) Comparison using wrong factors (CVE-ID: CVE-2026-9800)
CWE-ID: CWE-1025 - Comparison using wrong factors
CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to bypass authorization policies and gain unauthorized access to protected resources.
The vulnerability exists due to comparison using wrong factors in the Keycloak Policy Enforcer when handling request URLs containing the configured access-denied page path. A remote user can include the configured access-denied page path in a request URL as a path segment or query parameter to bypass authorization policies and gain unauthorized access to protected resources.
This can bypass role, scope, and User-Managed Access (UMA) permission checks.
21) Improper Validation of Specified Quantity in Input (CVE-ID: CVE-2026-9801)
CWE-ID: CWE-1284 - Improper Validation of Specified Quantity in Input
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to cause a denial of service.
The vulnerability exists due to improper validation of specified quantity in input in the LDAP password policy response handling when processing a password authentication request. A remote privileged user can send a malformed LDAP password policy response to cause a denial of service.
The error terminates the Keycloak Java Virtual Machine and disrupts all realms on the affected node.
22) Insufficient Session Expiration (CVE-ID: CVE-2026-9802)
CWE-ID: CWE-613 - Insufficient Session Expiration
CVSSv4: 7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to gain unauthorized access to a victim\'s account.
The vulnerability exists due to insufficient session expiration in Keycloak persistent session handling when revokeRefreshToken=true is enabled, persistent session storage is in use, and the server restarts. A remote attacker can replay a previously captured and revoked refresh token to gain unauthorized access to a victim\'s account.
User interaction is required.
23) Improper Validation of Specified Quantity in Input (CVE-ID: CVE-2026-9704)
CWE-ID: CWE-1284 - Improper Validation of Specified Quantity in Input
CVSSv4: 7.6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to escalate privileges.
The vulnerability exists due to improper validation of specified quantity in input in the TokenEndpoint when processing an oversized subject_token JSON Web Token (JWT). A remote user can send an oversized subject_token JWT to gain the permissions of the client\'s service account and escalate privileges.
Remediation
Install update from vendor's website.