SB2026091847 - Multiple vulnerabilities in Keycloak

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026091847

SB2026091847 - Multiple vulnerabilities in Keycloak

Published: September 18, 2026

Security Bulletin ID SB2026091847
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 6
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Medium 83% Low 17%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 6 vulnerabilities.


1) Incorrect Comparison (CVE-ID: CVE-2026-90997)

CWE-ID: CWE-697 - Incorrect Comparison

CVSSv4: 9.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to gain unauthorized access to the token endpoint or login flow.

The vulnerability exists due to a mismatch in row-count semantics between the database driver and Keycloak's application logic in Keycloak's replay protection mechanism when processing intercepted single-use security artifacts. A remote attacker can replay an intercepted JWT client assertion, DPoP proof, or one-time password code to gain unauthorized access to the token endpoint or login flow.

Only Keycloak deployments operating in stateless mode with MySQL or MariaDB are affected.


2) Resource exhaustion (CVE-ID: CVE-2026-79651)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to uncontrolled resource consumption in the theme localization endpoints of the keycloak-services component when processing unauthenticated requests containing arbitrary locale tags. A remote attacker can send a large number of unique locale tags to exhaust memory and cause a denial of service.

The supplied locale tags are stored in a permanent in-memory cache without limits.


3) Missing Authorization (CVE-ID: CVE-2026-74909)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to gain unauthorized access to sensitive administrative or private application endpoints.

The vulnerability exists due to missing authorization in the Keycloak policy enforcer when processing web addresses containing specially encoded characters. A remote user can send a request containing encoded semicolons or directory traversal segments to cause the enforcer to apply a less restrictive security policy.


4) Improper Authentication (CVE-ID: CVE-2026-19607)

CWE-ID: CWE-287 - Improper Authentication

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper authentication in the first-broker-login flow of the keycloak-services component when linking an account through an external identity provider. A remote attacker can register a matching username with an external identity provider to cause a denial of service.


5) Missing Authorization (CVE-ID: CVE-2026-17526)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to gain full administrative control over a realm.

The vulnerability exists due to missing authorization in Keycloak impersonation functionality when impersonating users. A remote privileged user can impersonate a realm administrator to gain full administrative control over a realm.


6) Memory leak (CVE-ID: CVE-2026-18212)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to missing release of memory after effective lifetime in the custom DEFLATE compression and decompression helpers of the SAML Redirect Binding implementation when processing repeated malformed SAML requests. A remote attacker can send repeated malformed SAML requests to cause a denial of service.


Remediation

Install update from vendor's website.

References