org.keycloak:keycloak-services@26.3.0

org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services.

Affected versions of this package are vulnerable to Missing Authorization through the TokenManager component in the identity management service. An attacker can continue using previously issued tokens by presenting them after an administrator applies a client-specific “not-before” revocation policy while the realm already has an older non-zero revocation policy in place. This leaves revoked tokens valid for refreshing sessions and accessing user information, so administrators cannot reliably invalidate a client’s existing tokens.

There is no fixed version for org.keycloak:keycloak-services.

org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services.

Affected versions of this package are vulnerable to Access Control Bypass through the Client-Initiated Backchannel Authentication token redemption handler in the keycloak-services component. An attacker can obtain access and refresh tokens for a locked user account by redeeming a previously started CIBA authentication request after the account has been locked, provided the request was approved by the user and the attacker has valid client credentials. The vulnerable code path lets token redemption proceed even when brute-force protection has already locked the account. This leaves users exposed to unauthorized token issuance for accounts that were expected to be blocked, undermining the lockout’s protection against continued authentication attempts.

There is no fixed version for org.keycloak:keycloak-services.

org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services.

Affected versions of this package are vulnerable to Reliance on Untrusted Inputs in a Security Decision through the client authentication flow in the client policies and assertion handling components. An attacker can authenticate with weaker client credentials by supplying a fake unsigned assertion header that makes the server believe the policy requirements have been satisfied. This defeats administrator-mandated requirements for signed JWT assertions and lets a client complete authentication with a simpler method such as a client secret, weakening client authentication controls.

There is no fixed version for org.keycloak:keycloak-services.

org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services.

Affected versions of this package are vulnerable to Information Exposure due to insufficient group-permission filtering in RealmAdminResource.getRealm(), RealmAdminResource.getDefaultGroups(), and RealmsAdminResource.toRealmRep() in the admin REST API. A delegated administrator can enumerate hidden default groups by requesting the realm representation or the default-groups endpoint after being granted realm-view permissions but denied per-group view access.

This exposes the names, paths, and identifiers of default groups that should remain hidden, revealing internal organizational structure to users who do not have permission to view those groups.

Notes

• FGAP v2 must be enabled for the hidden-default-group checks to matter; the issue is in the delegated-admin/admin-permissions path that evaluates realm and group view rights separately.
• The disclosure also affects the realm listing returned by admin/realms via RealmsAdminResource.toRealmRep(), not just the dedicated default-groups endpoint.

A fix was pushed into the master branch but not yet published.

org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services.

Affected versions of this package are vulnerable to Missing Authorization through the Google token exchange flow in the Google Identity Provider token exchange process. An attacker can gain access to a Keycloak realm by supplying a valid Google token from a non-approved Google Workspace domain and exchanging it for a Keycloak token. The issue affects deployments that rely on Google domain restrictions to limit which accounts may sign in, allowing users from disallowed domains to authenticate successfully.

There is no fixed version for org.keycloak:keycloak-services.

org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services.

Affected versions of this package are vulnerable to Missing Authorization in the admin REST API through the deleteComposites role-composite deletion path in RoleResource, RoleContainerResource, and RoleByIdResource. An attacker with limited administrative permissions can remove privileged child roles from a composite role by sending DELETE requests to the role composite endpoints. The vulnerable endpoints only checked manage permission on the parent role and did not enforce per-child role authorization before role.removeCompositeRole(composite). As a result, a delegated administrator can strip roles they are not authorized to map, breaking role assignments for other users and administrators and causing access loss.

A fix was pushed into the master branch but not yet published.

org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services.

Affected versions of this package are vulnerable to Improper Authentication through the Microsoft account token exchange flow in the Microsoft identity provider component. An attacker can gain unauthorized access to a Keycloak realm by supplying a valid Microsoft token from a different organization and exchanging it. This bypasses the tenant restriction intended to limit logins to a specific Microsoft organization, allowing access to sensitive data and unauthorized actions in deployments that rely on that restriction.

There is no fixed version for org.keycloak:keycloak-services.

org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services.

Affected versions of this package are vulnerable to Missing Authorization in the RoleContainerResource admin REST composite-role endpoints. A delegated administrator can remove child roles from built-in admin roles by sending name-based composite-role requests against the realm admin API, bypassing the per-role checks that should gate those updates. This can strip essential permissions such as manage-users, manage-clients, or impersonation from administrative roles, disrupting or degrading administrative access within the realm.

A fix was pushed into the master branch but not yet published.

org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services.

Affected versions of this package are vulnerable to Missing Authorization due to the full-scope-disabled client-policy executor. An attacker can create a client with full scope access by omitting the fullScopeAllowed field from a client registration or configuration request. This lets a delegated user obtain tokens with unauthorized role mappings for the resulting client. The impact is that clients are created with broader permissions than the policy allows, enabling access to roles the user should not be able to assign.

There is no fixed version for org.keycloak:keycloak-services.

org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services.

Affected versions of this package are vulnerable to Access of Resource Using Incompatible Type ('Type Confusion') in ProtocolMappersClientRegistrationPolicy via the Dynamic Client Registration client update path. An attacker with client registration privileges can bypass the “Allowed Protocol Mapper Types” restriction by updating an existing mapper so its configuration stays the same while changing its mapper type to a restricted one, then use that mapper to hardcode privileged roles and gain full administrative access to the realm.

Upgrade org.keycloak:keycloak-services to version 26.4.14, 26.6.5, 26.7.1 or higher.

org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services.

Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature during identity provider metadata import. An attacker can forge a SAML response and gain unauthorized access to a user account by importing metadata that includes a signing certificate but omits the key use attribute, leaving signature validation disabled for the broker endpoint. When the imported IdP metadata is processed, the signing certificate is stored, but the response signature is not checked, so a forged assertion can be accepted for a known external identifier. This affects SAML identity brokering in deployments that import attacker-supplied or maliciously modified IdP metadata.

Upgrade org.keycloak:keycloak-services to version 26.4.14, 26.6.5, 26.7.1 or higher.

org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services.

Affected versions of this package are vulnerable to Information Exposure through the OIDCClientSecretConfigWrapper in services/src/main/java/org/keycloak/protocol/oidc/OIDCClientSecretConfigWrapper.java. An attacker can retrieve the resolved plaintext value of a vault-backed rotated client secret by calling the rotated client-secret Admin REST endpoint for a client configured with a vault placeholder. A delegated administrator with view-only access to client secret data receives the actual secret instead of the stored vault expression, exposing sensitive credentials and allowing unauthorized use of the client secret.

A fix was pushed into the master branch but not yet published.

org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services.

Affected versions of this package are vulnerable to Missing Authorization through the OIDC token introspection endpoint in the keycloak-services component. An attacker can access sensitive token claims by sending an introspection request for a token issued to a different audience from a confidential client configured to receive signed JWT introspection responses. The endpoint marks the token inactive for that client, but it still returns the token’s full claims inside the signed JWT response. This lets an unauthorized client recover audience-restricted token data that should not be exposed.

There is no fixed version for org.keycloak:keycloak-services.

org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services.

Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature in the backchannel logout endpoint of the keycloak-services component. An attacker can force a user to log out by sending a logout request without a cryptographic signature when an OIDC identity provider is configured to skip signature validation. This lets the attacker disrupt the user’s active session and break access to applications until the user signs in again.

There is no fixed version for org.keycloak:keycloak-services.

org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services.

Affected versions of this package are vulnerable to Information Exposure through the AuthenticationManagementResource in services/src/main/java/org/keycloak/services/resources/admin/AuthenticationManagementResource.java. An attacker can retrieve raw authenticator configuration secrets by requesting authentication config data through the admin API as a user with view-only permissions. The vulnerable GET paths return ModelToRepresentation.toRepresentation(config) without masking sensitive entries, so values such as reCAPTCHA secret keys are exposed in the response and can also appear in administrative logs. This leaks third-party service credentials to unauthorized administrators and can expose secrets used by the realm’s authentication flows.

Notes

• The leak is limited to the admin GET endpoints that return authenticator-config representations, so only deployments where administrators can view authentication configs through the admin API are exposed.
• The exposed values are those stored in authenticator config metadata, including provider-defined secrets and legacy/unknown keys that are not recognized as non-secret by the provider registry.

A fix was pushed into the master branch but not yet published.

org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services.

Affected versions of this package are vulnerable to Improper Validation of Consistency within Input in the identity provider update flow for OIDC identity providers. An attacker can capture the existing client secret by sending an update as a delegated administrator that reuses the masked client secret sentinel value while changing security-sensitive settings such as the token URL. The vulnerable code path manages identity provider configuration updates in keycloak-services, and it accepts the update without forcing the secret to be revalidated against the changed endpoint. This lets the attacker redirect secret-bearing requests to an endpoint they control and expose the real client secret, breaking the confidentiality of the identity provider credentials.

There is no fixed version for org.keycloak:keycloak-services.

org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services.

Affected versions of this package are vulnerable to DNS Rebinding in the client host restriction logic. An attacker can bypass wildcard domain restrictions on client registration or updates by controlling the reverse DNS for their connection and presenting a hostname that merely ends with the configured suffix, such as *.example.com, even when it is not a real subdomain. This lets an unauthorized party modify clients in realms that rely on host-based allowlists, breaking the intended restriction on who can register or update client settings.

There is no fixed version for org.keycloak:keycloak-services.

org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services.

Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key due to the OAuth 2.0 authorization code handling. An attacker can obtain access tokens for a victim’s identity by intercepting an authorization code and redeeming it with their own client. The affected code path does not bind the authorization code to the client that originally requested it, so a stolen code can be substituted during token exchange and used to log in as the victim.

There is no fixed version for org.keycloak:keycloak-services.

org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services.

Affected versions of this package are vulnerable to Improper Validation of Consistency within Input due to improper validation of the email_verified claim in the OIDC authentication. An attacker can cause arbitrary email addresses to be marked as verified by configuring a malicious or compromised upstream identity provider and exploiting the lack of correlation between the id_token and the userinfo endpoint responses.

Note: This is only exploitable if the OIDC identity provider is configured with trustEmail set to true and the userinfo endpoint is enabled.

There is no fixed version for org.keycloak:keycloak-services.

org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services.

Affected versions of this package are vulnerable to Incorrect Authorization via the ClientResource component in the admin REST API when Fine-Grained Admin Permissions (FGAP) v2 is enabled. An attacker can modify the contents of issued tokens and inject unauthorized data or permissions by bypassing authorization checks on client scope assignments.

Note: This is only exploitable if the attacker holds a delegated administrator role with specific client management permissions and possesses knowledge of internal resource identifiers (UUIDs).

Upgrade org.keycloak:keycloak-services to version 26.7.1 or higher.

org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services.

Affected versions of this package are vulnerable to Incorrect Authorization in the RoleContainerResource process when FGAP v2 is enabled. An attacker can access unauthorized group metadata by enumerating role-to-group mappings if they possess a delegated administrative role with specific view permissions.

Note: This is only exploitable if the attacker already has a delegated administrative role with view permissions for roles but not for all groups.

There is no fixed version for org.keycloak:keycloak-services.

org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services.

Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the addChild endpoint in the Admin REST API when Fine-Grained Admin Permissions v2 are enabled. An attacker with delegated manage-members permissions on a low-privilege group can bypass authorization checks to reparent any group, including those with elevated privileges, under their control. This enables the attacker to reset passwords of members in the targeted group and potentially take over the entire realm by compromising privileged accounts.

Upgrade org.keycloak:keycloak-services to version 26.4.13, 26.6.4 or higher.

org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services.

Affected versions of this package are vulnerable to Directory Traversal via the keystore parameter when creating a key provider component. An attacker can determine the existence and readability of files on the server by submitting crafted filesystem paths. This is only exploitable if the attacker possesses the "manage-realm" administrative role.

Upgrade org.keycloak:keycloak-services to version 26.4.13, 26.6.4 or higher.

org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services.

Affected versions of this package are vulnerable to Insufficient Session Expiration via the Registration Access Token process. An attacker can gain unauthorized access to resources and modify client configurations by using a previously issued token to re-enable a disabled client, reset its secret, and restore OAuth client_credentials capability, thereby bypassing administrative controls.

Upgrade org.keycloak:keycloak-services to version 26.4.13, 26.6.4 or higher.

org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) via the client URI validation process. An attacker can execute arbitrary scripts in the context of the application by registering a malicious client with a specially crafted redirect URI using mixed-case javascript: or data: schemes and tricking a victim into interacting with a crafted link, such as during the logout flow. This is only exploitable if the attacker has administrative privileges with manage-client permission or access to client registration endpoints, and user interaction occurs.

Upgrade org.keycloak:keycloak-services to version 26.4.13, 26.6.4 or higher.

org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services.

Affected versions of this package are vulnerable to Incorrect Privilege Assignment in the Identity Provider mapper process. An attacker can gain unauthorized administrative privileges by creating a hardcoded role mapping that assigns elevated roles to themselves or others, thereby bypassing intended authorization checks.

There is no fixed version for org.keycloak:keycloak-services.

org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services.

Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature via the JWT Authorization Grant flow due to algorithm confusion in signature verification. An attacker can gain unauthorized access and potentially escalate privileges by forging assertions and creating unauthorized access tokens.

Upgrade org.keycloak:keycloak-services to version 26.6.4 or higher.

org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services.

Affected versions of this package are vulnerable to Insufficient Granularity of Access Control in the getMembers() methods that serve the group members endpoint. An admin user with delegated access to read group memberships and users can read user profile attributes that are explicitly configured to be denied by using their delegated administrative access to expose those values over the group membership API.

Upgrade org.keycloak:keycloak-services to version 26.6.3 or higher.

org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services.

Affected versions of this package are vulnerable to Information Exposure via the SAML ECP endpoint when specially crafted SOAP requests are sent with varying client IDs. An attacker can obtain protocol type information associated with different client IDs by analyzing the faultstrings in the responses.

Upgrade org.keycloak:keycloak-services to version 26.6.3 or higher.

org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services.

Affected versions of this package are vulnerable to Improper Validation of Specified Quantity in Input in the TokenEndpoint endpoint when an oversized subject_token JWT exceeding 4000 characters is submitted. An attacker can gain unintended service account permissions by exploiting the fallback to client credentials that occurs when the oversized token is silently dropped.

Upgrade org.keycloak:keycloak-services to version 26.6.3 or higher.

org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services.

Affected versions of this package are vulnerable to Incorrect Privilege Assignment via improper enforcement of scope mapping in the Fine-Grained Admin Permissions (FGAPv2) feature due to ScopeMappedResource and ScopeMappedClientResource write endpoints missing a call to requireMapClientScope per role. An attacker can gain unauthorized access to privileged roles by injecting arbitrary realm roles into a client's scope, which are then projected into a user's authentication token upon login through the compromised client. This is only exploitable if Fine-Grained Admin Permissions (FGAPv2) are enabled and the attacker has fine-grained client management permissions, and a privileged user subsequently authenticates through the affected client.

Upgrade org.keycloak:keycloak-services to version 26.6.3 or higher.

org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services.

Affected versions of this package are vulnerable to Improper Validation of Consistency within Input via the authentication process when a client is configured with a wildcard redirect URI. An attacker can cause the client application to incorrectly process attacker-controlled OIDC response parameters by crafting a malicious authorization URL and tricking a user into clicking it.

Upgrade org.keycloak:keycloak-services to version 26.7.0 or higher.

org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services.

Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature via the requestObjectSignatureAlg policy bypass during the processing of JWE-encrypted request objects containing raw JSON plaintext. An attacker can submit unauthorized claims by crafting specially formed JWE-encrypted request objects, potentially compromising data integrity within the OpenID Connect authorization flow.

Upgrade org.keycloak:keycloak-services to version 26.7.1 or higher.

org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services.

Affected versions of this package are vulnerable to Insufficient Session Expiration due to the startupTime reset during server restart when revokeRefreshToken=true and persistent session storage is enabled. An attacker can gain unauthorized access to user accounts by replaying a previously revoked refresh token that was captured before the restart.

Upgrade org.keycloak:keycloak-services to version 26.6.3 or higher.

org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services.

Affected versions of this package are vulnerable to Authentication Bypass by Primary Weakness via the Client-Initiated Backchannel Authentication (CIBA) flow. An attacker can continue authentication attempts and obtain tokens by exploiting the CIBA flow even when a user account is locked due to brute-force protection. This is only exploitable if CIBA is explicitly enabled and configured, and the user approves the authentication request on their device.

Upgrade org.keycloak:keycloak-services to version 26.6.3 or higher.

org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services.

Affected versions of this package are vulnerable to Out-of-bounds Read via the authorization header parsing in the ClientRegistrationAuth component. An attacker can cause a temporary disruption of service by sending a specially crafted request with a malformed 'Authorization: Bearer' header, which triggers an ArrayIndexOutOfBoundsException and results in an HTTP 500 error.

Upgrade org.keycloak:keycloak-services to version 26.6.3 or higher.

org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services.

Affected versions of this package are vulnerable to Time-of-check Time-of-use (TOCTOU) Race Condition in the role rename endpoint. An attacker can gain unauthorized administrative privileges by exploiting a timing window between permission checks and their enforcement. The attacker can escalate their access to realm-wide administrative control, even after their original permissions are revoked and across system reboots.

Upgrade org.keycloak:keycloak-services to version 26.7.0 or higher.

org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services.

Affected versions of this package are vulnerable to Incorrect Authorization via the user-facing APIs when the Organizations feature is disabled. An attacker can access organization membership data and obtain tokens containing organization claims by making authenticated requests, even after an administrator has disabled the feature at the realm level.

Upgrade org.keycloak:keycloak-services to version 26.6.3 or higher.

org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services.

Affected versions of this package are vulnerable to Improper Handling of Insufficient Permissions or Privileges in the org.keycloak.protocol.oidc component when specific condition providers such as client-type, client-roles, client-attributes, or client-scopes are used. An attacker can gain unauthorized access and obtain authentication tokens by bypassing configured policy restrictions through Resource Owner Password Credentials (ROPC) grants, even when policies are set to block such requests. This is only exploitable if client policies rely on these condition providers to enforce ROPC grant rejection.

Upgrade org.keycloak:keycloak-services to version 26.6.3 or higher.

org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services.

Affected versions of this package are vulnerable to Incorrect Implementation of Authentication Algorithm through the TokenManager and OIDC endpoint token checks in the access token introspection, refresh token, and userinfo paths. An attacker can keep using a token after a realm-level not-before event by presenting it to introspection, refresh, or userinfo requests when client-level not-before values are also in play. This lets revoked or otherwise invalidated tokens remain accepted, allowing continued access to protected account, userinfo, and token-refresh operations until the token expires.

Upgrade org.keycloak:keycloak-services to version 26.6.3 or higher.

org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services.

Affected versions of this package are vulnerable to Client-Side Enforcement of Server-Side Security through the processAction() registration flow in the WebAuthn authenticator components. An attacker can register a credential that does not match the realm’s WebAuthn policy by modifying the browser-side registration parameters or by using an authenticator that returns a different algorithm than requested. The server accepts and stores credentials with disallowed algorithms or other mismatched registration properties, and the same stored credential is then used for future logins without any server-side policy check, leaving users with WebAuthn credentials that do not enforce the administrator’s configured requirements.

Upgrade org.keycloak:keycloak-services to version 26.6.3 or higher.

org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services.

Affected versions of this package are vulnerable to User Impersonation through the SessionCodeChecks logic in SessionCodeChecks.java. An attacker can reuse an auth_session_id and related login-action parameters from a different browser session to reach the authentication flow and trigger login or required-action processing without the expected session-cookie match. This lets the attacker force the server to accept a mismatched authentication session, resulting in unauthorized access to the login action flow and potential account takeover or session confusion for the victim.

Note: While the fix was back-ported to version 26.4.12, this version has not been published to Maven Central

Upgrade org.keycloak:keycloak-services to version 26.6.2 or higher.

org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services.

Affected versions of this package are vulnerable to Open Redirect through the areWildcardsAllowed check in RedirectUtils. An attacker can bypass redirect URI validation by supplying a redirect URI with an unparsed authority component and wildcard patterns, thereby sending users to an attacker-controlled destination.

Notes

• Clients only become vulnerable when their Valid Redirect URIs include a wildcard (*); exact-match redirect URI configurations are not affected by this bypass.
• Exploitation depends on a malformed redirect URI whose authority cannot be parsed cleanly by Java’s URI handling, such as one using multiple @ characters in the user-info portion.

Upgrade org.keycloak:keycloak-services to version 26.6.2 or higher.

org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services.

Affected versions of this package are vulnerable to Open Redirect via the TokenEndpoint introspection flow in the OIDC protocol handlers. An attacker can introspect tokens intended for another client by sending them to the token introspection endpoint from an authenticated client that is not listed in the token’s aud claim, exposing token metadata and claims for tokens outside that client’s intended audience.

Note: While the fix was back-ported to version 26.4.12, this version has not been published to Maven Central

Upgrade org.keycloak:keycloak-services to version 26.6.2 or higher.

org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services.

Affected versions of this package are vulnerable to External Control of Assumed-Immutable Web Parameter via the SessionCodeChecks restart flow in the login session handling code. An attacker can steer a restarted authentication session to an attacker-chosen URL by supplying a crafted client_data parameter with a different redirect_uri, causing the victim’s browser to be redirected to the attacker’s endpoint after login. This can send the user’s authorization response to the wrong location, exposing the login result to an untrusted site.

Note: While the fix was back-ported to version 26.4.12, this version has not been published to Maven Central

Upgrade org.keycloak:keycloak-services to version 26.6.2 or higher.

org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services.

Affected versions of this package are vulnerable to Replay Attack through the RequiredActionFactory and required-action implementations in the authentication flow. An attacker can reuse a required-action email token by completing the action and then opening the same link again, causing the same account-management action to be accepted more than once. This lets a stale execute-actions-email link remain valid for repeated use, allowing repeated password updates, TOTP enrollment, account deletion, or other required actions to be triggered from the same token and undermining the intended single-use behavior.

Notes

• The replay issue is not limited to password resets: any required action implemented through RequiredActionFactory and exposed via execute-actions-email inherits the same single-use semantics, including flows such as TOTP enrollment, account deletion, and WebAuthn-related enrollment paths.
• The vulnerable behavior is in the default isOneTimeAction() contract, so deployments that rely on custom required-action providers without their own override can also be affected even if the built-in actions are not the only ones in use.
• While the fix was back-ported to version 26.4.12, this version has not been published to Maven Central

Upgrade org.keycloak:keycloak-services to version 26.6.2 or higher.

org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services.

Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the ResourceService in the resource management API. An attacker can update, read, list, or delete resources they do not own by sending requests to the resource endpoints with a valid protection token. This lets a non-owner take over or inspect protected resources and disrupt other users’ resource and permission management.

Note: While the fix was back-ported to version 26.4.12, this version has not been published to Maven Central

Upgrade org.keycloak:keycloak-services to version 26.6.2 or higher.

org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services.

Affected versions of this package are vulnerable to Insufficient Granularity of Access Control via the user handler in the resource account service. An attacker can retrieve another user’s profile details by sending a GET request with an arbitrary value parameter for a resource they can access. The endpoint returns the target user’s identifier, username, first name, last name, and email without verifying that the requester owns the user record or has a permission request for that resource, exposing account data to unauthorized callers.

Note: While the fix was back-ported to version 26.4.12, this version has not been published to Maven Central

Upgrade org.keycloak:keycloak-services to version 26.6.2 or higher.

org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services.

Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the generateAccessToken path in ClientScopeEvaluateResource.java. An attacker can generate client scope tokens for a user by supplying that user’s ID to client scope evaluation without having permission to view the user. The vulnerable flow resolves the target user and proceeds to generate a token without enforcing a user access check, allowing callers with client-scope evaluation access to act on users they are not authorized to inspect. This exposes user-related token data, allowing unauthorized administrators or users with low administrative privileges to evaluate scopes against arbitrary users.

Note: While the fix was back-ported to version 26.4.12, this version has not been published to Maven Central.

Upgrade org.keycloak:keycloak-services to version 26.6.2 or higher.

org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services.

Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key in the cross-session email verification process. An attacker can gain persistent access to another user's local account by consuming the verification proof when controlling an upstream identity provider account that shares an email address with the victim. This is only exploitable if the attacker controls an upstream identity provider account with the same email as the victim, the victim is actively linking their account, email verification is enabled, and the identity provider is configured with trustEmail=false.

Upgrade org.keycloak:keycloak-services to version 26.6.3 or higher.

org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services.

Affected versions of this package are vulnerable to Improper Certificate Validation via packed self-attestation in WebAuthn registration. An attacker can bypass the AAGUID allowlist by returning self-attestation when direct attestation is requested, as the AAGUID is not verified in this case, allowing registration with an unapproved authenticator.

The attack surface is limited, as project maintainers note: "By default, for a simple implementation, attestation and AAGUIDs may not be considered necessary."

Upgrade org.keycloak:keycloak-services to version 26.6.2 or higher.

org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services.

Affected versions of this package are vulnerable to Forced Browsing via the account and account-api features when the server is started with --features-disabled=account,account-api. An authenticated user with API access can perform unauthorized read and write operations on specific account endpoints by bypassing the intended feature disablement.

Upgrade org.keycloak:keycloak-services to version 26.6.3 or higher.

org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services.

Affected versions of this package are vulnerable to Origin Validation Error in the UMA token endpoint when the azp claim from a client-supplied JWT is used to set the Access-Control-Allow-Origin header before the JWT signature is validated. An attacker can cause low-sensitivity information from authorization server error responses to be exposed by injecting a specially crafted JWT with a malicious azp value, which is reflected as the CORS origin.

Note:

This is only exploitable if the target client is misconfigured with webOrigins: ["*"].

Upgrade org.keycloak:keycloak-services to version 26.6.3 or higher.

org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services.

Affected versions of this package are vulnerable to Excessive Platform Resource Consumption within a Loop via the scope parameter processing in the OpenID Connect (OIDC) token endpoint. An attacker can exhaust server resources and cause prolonged response times by sending a specially crafted POST request with an excessively long scope value.

Upgrade org.keycloak:keycloak-services to version 26.5.7 or higher.

org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services.

Affected versions of this package are vulnerable to Improper Isolation or Compartmentalization due to improper type and namespace isolation in the SingleUseObjectProvider. An attacker can obtain unauthorized access by forging authorization codes, which may result in the creation of admin-level access tokens.

Upgrade org.keycloak:keycloak-services to version 26.5.7 or higher.

org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services.

Affected versions of this package are vulnerable to Open Redirect via improper validation of redirect URIs in the authentication endpoint. An attacker can gain unauthorized access to sensitive information by exploiting path traversal sequences in the redirect parameter, potentially leading to the theft of access tokens.

Upgrade org.keycloak:keycloak-services to version 26.5.7 or higher.

org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services.

Affected versions of this package are vulnerable to Incorrect Behavior Order: Authorization Before Parsing and Canonicalization via the UMA Policy Resource (user with the uma_protection role). An attacker can gain unauthorized access to resources owned by other users by including their resource identifiers in a policy creation request, allowing them to obtain sensitive information or perform actions without proper authorization.

Upgrade org.keycloak:keycloak-services to version 26.5.7 or higher.

org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services.

Affected versions of this package are vulnerable to Improper Isolation or Compartmentalization through improper handling of single-use entries in the SingleUseObjectProvider a global key-value store. An attacker can gain unauthorized access or compromise accounts by replaying consumed action tokens, such as password reset links.

Upgrade org.keycloak:keycloak-services to version 26.5.7 or higher.

org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services.

Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) via the client_session_host parameter during refresh token requests when the client is configured to use the backchannel.logout.url with the application.session.host placeholder. An attacker can cause the server to make HTTP requests to arbitrary internal or external endpoints by manipulating this parameter, potentially leading to information disclosure by probing internal networks or APIs.

Upgrade org.keycloak:keycloak-services to version 26.6.3 or higher.

org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services.

Affected versions of this package are vulnerable to Information Exposure in the identity-first login flow when Organizations are enabled. An attacker can obtain information about the existence of users by analyzing differential error messages.

Upgrade org.keycloak:keycloak-services to version 26.6.1 or higher.

org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services.

Affected versions of this package are vulnerable to Access Control Bypass due to incomplete enforcement of access control checks on PUT operations to the resource_set endpoint. An attacker can modify protected resources without proper authorization by sending crafted requests to this endpoint when the allowRemoteResourceManagement setting is set to false.

Upgrade org.keycloak:keycloak-services to version 26.6.2 or higher.

org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services.

Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) when processing client configuration requests. An attacker can make unintended requests to internal or restricted resources by sending a malicious sector_identifier_uri that accesses addresses such as a cloud metadata services at 169.254.169.254.

Upgrade org.keycloak:keycloak-services to version 26.6.1 or higher.

org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services.

Affected versions of this package are vulnerable to Improper Validation of Specified Type of Input via improper validation of encrypted SAML assertions. An attacker can gain unauthorized access by submitting specially crafted SAML assertions.

Upgrade org.keycloak:keycloak-services to version 26.2.14, 26.4.10, 26.5.5 or higher.

org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services.

Affected versions of this package are vulnerable to Authentication Bypass by Primary Weakness via the SAML Identity Provider authentication process when it is disabled. An attacker can gain unauthorized access by exploiting the ability to authenticate through a provider that should not be available.

Upgrade org.keycloak:keycloak-services to version 26.2.14, 26.4.10, 26.5.5 or higher.

org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services.

Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the IdentityBrokerService.performLogin endpoint. An attacker can gain unauthorized access and bypass administrative restrictions by reusing a previously generated login request referencing a disabled external identity provider.

Upgrade org.keycloak:keycloak-services to version 26.2.14, 26.4.10, 26.5.5 or higher.

org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services.

Affected versions of this package are vulnerable to Authentication Bypass by Primary Weakness when a disabled SAML client is configured as an Identity Provider (IdP)-initiated broker landing target. An attacker can gain unauthorized access to other enabled clients via a Single Sign-On (SSO) session.

Upgrade org.keycloak:keycloak-services to version 26.2.14, 26.4.10, 26.5.5 or higher.

org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services.

Affected versions of this package are vulnerable to Missing Critical Step in Authentication due to insufficient validation of the authentication Level of Assurance in the Account REST API. An attacker can gain control over a victim's account by deleting the victim's registered MFA device and registering their own, provided they have obtained the victim's primary credentials.

Upgrade org.keycloak:keycloak-services to version 26.5.7 or higher.

org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services.

Affected versions of this package are vulnerable to Improper Handling of Insufficient Permissions or Privileges via improper enforcement of roles in the UMA 2.0 Protection API which fails to enforce the uma_protection role check. An attacker can access sensitive information by leveraging insufficient permission checks.

Upgrade org.keycloak:keycloak-services to version 26.4.11, 26.5.6 or higher.

org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services.

Affected versions of this package are vulnerable to Incorrect Privilege Assignment via the manage-clients permission assignment. An attacker can gain unauthorized access to higher-privileged operations by exploiting insufficient enforcement of access controls.

Upgrade org.keycloak:keycloak-services to version 26.5.6 or higher.

org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services.

Affected versions of this package are vulnerable to Improper Authorization in the /protocol/docker-v2/auth endpoint, which does not ensure that the client is in “Enabled” status before granting an access token. This allows a user in possession of valid credentials and the client ID of a disabled client to bypass administrative restrictions.

Upgrade org.keycloak:keycloak-services to version 26.5.4 or higher.

org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services.

Affected versions of this package are vulnerable to Improper Handling of Highly Compressed Data (Data Amplification) via the SAMLRequest DEFLATE decompression. An attacker can cause service disruption by sending a highly compressed requests that trigger excessive resource consumption during decompression.

Upgrade org.keycloak:keycloak-services to version 26.5.4 or higher.

org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services.

Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the Admin API when the Organizations feature is enabled. An authenticated attacker can enumerate the organization memberships of any other user if their unique identifier (UUID) is known.

Note:

This is only exploitable if the Organizations feature is enabled (which is the default in recent versions), the attacker possesses a valid access token for the realm and the attacker knows the UUID of the victim user.

Upgrade org.keycloak:keycloak-services to version 26.5.6 or higher.

org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services.

Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature in the invitation tokens in the registration process. An attacker can gain unauthorized access to organizations by modifying the organization ID and target email within a legitimate invitation token's JWT payload.

Upgrade org.keycloak:keycloak-services to version 26.5.3 or higher.

org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services.

Affected versions of this package are vulnerable to Improperly Implemented Security Check for Standard due to improper verification if an Identity Provider (IdP) is enabled before issuing tokens. An attacker can gain unauthorized access by issuing valid access tokens using a disabled Identity Provider's signing key.

Upgrade org.keycloak:keycloak-services to version 26.5.3 or higher.

org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services.

Affected versions of this package are vulnerable to Incorrect Privilege Assignment due to insufficient ownership verification in the UserManagedPermissionService (UMA Protection API). An attacker can gain unauthorized access to modify or delete authorization rules for resources they do not own by updating or deleting a policy associated with multiple resources, where the authorization check only validates ownership of the first resource in the list.

Upgrade org.keycloak:keycloak-services to version 26.5.3 or higher.

org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services.

Affected versions of this package are vulnerable to Improper Enforcement of Behavioral Workflow via the Token Exchange implementation. An attacker can obtain access and refresh tokens for users who have been disabled by invoking the token exchange flow with a privileged client, potentially resulting in unauthorized access to previously revoked privileges.

Upgrade org.keycloak:keycloak-services to version 26.5.2 or higher.

org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services.

Affected versions of this package are vulnerable to Time-of-check Time-of-use (TOCTOU) Race Condition via the validateTokenReuse method in the TokenManager class. An attacker can obtain multiple access tokens from a single refresh token by making concurrent refresh requests.

Upgrade org.keycloak:keycloak-services to version 26.4.11, 26.5.6 or higher.

org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services.

Affected versions of this package are vulnerable to Missing XML Validation of the NotOnOrAfter timestamp in SubjectConfirmationData when SAML is configured to act as a client (SAML brokering). An attacker can extend the validity of SAML responses by manipulating the timestamp, potentially resulting in prolonged session durations or increased resource usage.

Upgrade org.keycloak:keycloak-services to version 26.5.4 or higher.

org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services.

Affected versions of this package are vulnerable to Incorrect Behavior Order: Authorization Before Parsing and Canonicalization due to the Authorization header parser accepting non-standard characters as separators and tolerating case variations that do not comply with RFC 6750 specifications. An attacker can bypass intended access restrictions by crafting specially formatted authentication headers.

Upgrade org.keycloak:keycloak-services to version 26.5.4 or higher.

org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services.

Affected versions of this package are vulnerable to Authentication Bypass by Alternate Name via the ResourceSetService and PermissionTicketService modules due to improper verification of resourceServer ID. An attacker can access and modify resources belonging to other clients by supplying a valid resourceId in the admin API endpoints, bypassing proper authorization checks.

Upgrade org.keycloak:keycloak-services to version 26.5.6 or higher.

org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services.

Affected versions of this package are vulnerable to Access Control Bypass via the /admin/realms/master/users/profile endpoint. An attacker can access internal user profile schema data by leveraging 'create-client' permissions.

Upgrade org.keycloak:keycloak-services to version 26.5.0 or higher.

org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services.

Affected versions of this package are vulnerable to Missing Critical Step in Authentication in the WebAuthn Attestation Statement verification. An attacker can influence policy enforcement by manipulating the registration flow or using a rogue authenticator under user control.

Upgrade org.keycloak:keycloak-services to version 26.5.1 or higher.

org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services.

Affected versions of this package are vulnerable to CRLF Injection during the e-mail registration. An attacker can cause the system to send unsolicited emails limited to 64 characters by injecting special characters into the email input field.

Upgrade org.keycloak:keycloak-services to version 26.3.3 or higher.

org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services.

Affected versions of this package are vulnerable to Insufficient Session Expiration in the "Remember Me" realm setting. An attacker with a long-lived "Remember Me" session (e.g., stole the identity cookie) can maintain access for the full original remember-me lifetime to gain unauthorized access to sensitive information or perform actions as another user.

Upgrade org.keycloak:keycloak-services to version 26.4.2 or higher.