6.8
Moyenne
CVE-2026-4630 A flaw was found in Keycloak
Description
A flaw was found in Keycloak. An authenticated client could exploit an Insecure Direct Object Reference (IDOR) vulnerability in the Authorization Services Protection API endpoint. By knowing or obtaining a resource's unique identifier (UUID) belonging to another Resource Server within the same realm, the client could bypass authorization checks. This allows the client to perform unauthorized GET, PUT, and DELETE operations on resources, leading to information disclosure and potential unauthorized modification or deletion of data.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Red Hat Build of Keycloak | Versions non publiées | |
| Red Hat build of Keycloak 26.4 26.4 | premières → < 26.4-17 | 26.4-17 |
| Red Hat build of Keycloak 26.4.12 | Versions non publiées |
Références
- RHSA-2026:19596 access.redhat.com
- RHSA-2026:19597 access.redhat.com
- access.redhat.com access.redhat.com
- RHBZ#2450245 bugzilla.redhat.com
Chronologie
- Publiée
- Dernière modification
Autres CVE de Red Hat Build of Keycloak
Les 276 CVE de Red Hat Build of Keycloak →
CVE-2026-9797
Keycloak: keycloak: privilege escalation via client authentication manipulation by an authenticated administrator
6.5
Moyenne
CVE-2026-97848
Keycloak-services: keycloak-services: protocol mapper with jsontype=json bypasses token sanitization
6.5
Moyenne
CVE-2026-97367
Keycloak-services: keycloak-services: dcr azp and sid claim substitution allows account rest session takeover
6.4
Moyenne
CVE-2026-96547
Keycloak-services: keycloak-services: dcr registration-time claim-path gap allows forging realm_access.roles
6.5
Moyenne