Skip to content
Threat Feed
Subscribe

CPE

Cpe:2.3:a:keycloak:keycloak:*:*:*:*:*:*:*:*

3 briefs RSS
low threat

Keycloak: Privilege escalation in admin REST API (CVE-2026-94000)

Keycloak versions up to 26.8.1 are vulnerable to privilege escalation where a user with "manage-users" permissions can assign composite roles containing "realm-admin" privileges due to incomplete authorization checks.

Keycloak SecFathy privilege-escalation authentication-bypass
1t 1c
high advisory

Keycloak Stateless Mode Replay Vulnerability (CVE-2026-90997)

A row-count mismatch in Keycloak when using MySQL or MariaDB in stateless mode allows attackers to bypass replay protection for single-use security artifacts like JWT client assertions, DPoP proofs, or TOTP codes.

Keycloak identity-management authentication-bypass vulnerability
1t 1c
low advisory

Denial of Service Vulnerability in Keycloak Theme Localization

An unauthenticated denial-of-service vulnerability in Keycloak (CVE-2026-79651) allows attackers to exhaust server memory by injecting arbitrary locale tags into an unbounded cache.

Keycloak denial-of-service vulnerability identity-management
1r 1t 1c