Tag
Keycloak Vulnerability Allows Data Confidentiality Breach and Security Policy Bypass
2 rules 1 TTP 1 CVEA vulnerability in Keycloak versions prior to 26.2.14, 26.4.10, and 26.5.5 allows an attacker to cause a breach of data confidentiality and bypass the security policy, as tracked by CVE-2026-2092.
Keycloak OIDC Implicit Flow Bypass Vulnerability (CVE-2026-7571)
2 rules 1 TTP 1 CVECVE-2026-7571 describes a vulnerability in Keycloak where a low-privilege user can bypass security controls intended to disable the implicit flow in OpenID Connect (OIDC) clients by manipulating client data during session restart, potentially exposing access tokens.
CVE-2026-7507: Keycloak Session Fixation Vulnerability in Login Actions Endpoints
2 rules 1 TTP 1 CVEA session fixation vulnerability in Keycloak's /login-actions/restart endpoint allows an unauthenticated attacker to hijack a user's session by crafting a malicious link that resets the authentication flow, potentially leading to account takeover.
Keycloak Open Redirect Vulnerability (CVE-2026-7504)
2 rules 1 TTP 1 CVEA vulnerability in Keycloak's URL validation allows attackers to redirect users to unauthorized URLs by exploiting discrepancies in the handling of the user-info component within URLs, potentially leading to sensitive information exposure.
Keycloak Security Bypass Vulnerability
2 rules 1 TTPAn authenticated remote attacker can exploit a vulnerability in Keycloak to bypass security measures.
Keycloak Vulnerability Allows Arbitrary Email Sending
2 rules 1 TTPAn anonymous, remote attacker can exploit a vulnerability in Keycloak to send arbitrary emails, potentially leading to phishing or social engineering attacks.
Multiple Vulnerabilities in Red Hat Build of Keycloak
2 rules 5 TTPsMultiple vulnerabilities in Red Hat Build of Keycloak could allow an attacker to bypass authentication, gain elevated privileges, disclose sensitive information, cause a denial of service condition, execute arbitrary code, or manipulate data.
Keycloak Cross-Site Scripting Vulnerability
2 rules 1 TTPAn authenticated remote attacker can exploit a vulnerability in Keycloak to perform a Cross-Site Scripting attack, potentially leading to unauthorized access and data compromise.
Keycloak UMA Policy Bypass Vulnerability (CVE-2026-4636)
2 rules 3 TTPs 1 CVECVE-2026-4636 describes a vulnerability in Keycloak where an authenticated user with the uma_protection role can bypass User-Managed Access (UMA) policy validation, leading to unauthorized access to victim-owned resources.
Keycloak Denial-of-Service Vulnerability via Excessive Scope Parameter (CVE-2026-4634)
2 rules 1 TTP 1 CVEAn unauthenticated attacker can cause a denial-of-service on Keycloak servers by sending a crafted POST request to the OIDC token endpoint with an excessively long scope parameter, leading to high resource consumption.
Keycloak Redirect URI Bypass Vulnerability (CVE-2026-3872)
2 rules 1 TTP 1 CVECVE-2026-3872 is a vulnerability in Keycloak that allows an attacker controlling a path on the same web server to bypass URI redirect validation using a wildcard, potentially leading to access token theft and information disclosure.
Keycloak Authorization Code Forging Vulnerability (CVE-2026-4282)
2 rules 1 TTP 1 CVEAn unauthenticated attacker can exploit CVE-2026-4282 in Keycloak's SingleUseObjectProvider to forge authorization codes, leading to privilege escalation and the creation of admin-capable access tokens.