All errata/c10f2/ALT-PU-2026-10842-2
ALT-PU-2026-10842-2

Package update keycloak in branch c10f2

Version26.7.0-alt1
Task#425163
Published2026-07-13
Max severityMEDIUM
Severity:

Closed issues (7)

CVE-2026-11986
MEDIUM4.9

A flaw was found in the admin-ui-ext component of Keycloak, which provides extended administrative user interface capabilities. The issue occurs because certain bulk role-removal endpoints fail to perform granular permission checks when deleting role mappings. This allows a delegated administrator with limited permissions to remove highly privileged roles from other users or groups, potentially disrupting administrative access control.

Published: 2026-06-11Modified: 2026-08-11
CVSS 3.xMEDIUM 4.9
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
References
CVE-2026-9689
MEDIUM4.2

A flaw was found in Keycloak, an open-source identity and access management solution. When a client application is configured to accept broad redirect Uniform Resource Identifiers (URIs), a remote attacker can manipulate the authentication process by crafting a special web address. If a user clicks this link, the client application might incorrectly prioritize attacker-controlled information over legitimate data. This vulnerability, known as HTTP parameter pollution, could allow an attacker to bypass security measures or gain unauthorized access to resources.

Published: 2026-05-27Modified: 2026-08-05
CVSS 3.xMEDIUM 4.2
CVSS:3.x/CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N
References
CVE-2026-9796
MEDIUM6.5

A flaw was found in Keycloak. An authenticated administrator with the `manage-clients` role can exploit a Time-of-check to time-of-use (TOCTOU) vulnerability in the name-based admin role checks. This allows the attacker to escalate their privileges to `realm-admin` for all users within the realm, granting them extensive control over the system. The composite role relationship persists even after the attacker's own permissions are revoked and across system reboots.

Published: 2026-05-28Modified: 2026-08-11
CVSS 3.xMEDIUM 6.5
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
References
CVE-2026-9798
MEDIUM4.3

A flaw was found in Keycloak, an open-source identity and access management solution. When a user account is temporarily locked due to repeated failed login attempts, an attacker with valid client credentials can exploit the Client-Initiated Backchannel Authentication (CIBA) flow to bypass this brute-force protection. This allows continued authentication attempts and token issuance even when the account should be locked, potentially enabling further unauthorized access attempts.

Published: 2026-05-28Modified: 2026-08-05
CVSS 3.xMEDIUM 4.3
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
References
GHSA-pq65-77rc-7r8c
MEDIUM6.5

Keycloak has a Time-of-check Time-of-use (TOCTOU) Race Condition

Published: 2026-05-28Modified: 2026-07-01
CVSS 3.xMEDIUM 6.5
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
References
GHSA-q6h7-xxp7-7429
MEDIUM4.3

Keycloak has an Authentication Bypass by Primary Weakness

Published: 2026-05-28Modified: 2026-08-05
CVSS 3.xMEDIUM 4.3
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
References
GHSA-wcvj-vpvw-9rr5
MEDIUM4.2

Keycloak Services has Improper Validation of Consistency within Input

Published: 2026-05-27Modified: 2026-08-05
CVSS 3.xMEDIUM 4.2
CVSS:3.x/CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N
References