Security feed

24 October 2026

advisoryOfficial CVE List24 Oct 2026

Keycloak-services: keycloak-services: unbounded metric series creation via idp tag on broker login endpoint

A flaw was found in the Micrometer user-event metrics listener of Keycloak, a solution for integrated identity and access management. The issue occurs when the listener is configured to include the idp tag. An unauthenticated attacker can send requests to the identity broker login endpoint using arbitrary provider aliases, causing the system to create an unlimited number of metric time series. This can lead to excessive memory consumption and degrade the performance of both the server and its monitoring tools.

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-101333

Red Hat Build of Keycloak

Source reference: /containers/cna/affected/0/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat Build of Keycloak

Source reference: /containers/cna/affected/1/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat Single Sign-On 7

Source reference: /containers/cna/affected/2/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2026-101333
Source reference: /cveMetadata/cveId

Publisher severity

low

Source reference: /containers/cna/metrics

Event: #3156 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 21:30:48 GMT
Publisher date: Mon, 28 Sep 2026 14:38:15 GMT

Read the original announcement

advisoryOfficial CVE List24 Oct 2026

Keycloak-services: keycloak-services: essential acr requirement silently bypassed via cookie authenticator

A flaw was found in the Level of Authentication enforcement mechanism of Keycloak, an identity and access management solution. The issue occurs when a client specifically requires a higher security level for a user who already has an active session at a lower level. Due to a logic error in how session re-evaluations are handled, Keycloak may incorrectly issue a token at the lower security level instead of enforcing the required higher level, potentially allowing unauthorized access to sensitive resources that rely on these security claims.

Red Hat Build of Keycloak Red Hat Build of Keycloak Red Hat Single Sign-On 7 CVE-2026-97176

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-97176

Red Hat Build of Keycloak

Source reference: /containers/cna/affected/0/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat Build of Keycloak

Source reference: /containers/cna/affected/1/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat Single Sign-On 7

Source reference: /containers/cna/affected/2/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2026-97176
Source reference: /cveMetadata/cveId

Publisher severity

medium

Source reference: /containers/cna/metrics

Event: #2422 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 21:18:16 GMT
Publisher date: Thu, 24 Sep 2026 05:47:52 GMT

Read the original announcement

advisoryOfficial CVE List24 Oct 2026

Keycloak-services: keycloak-services: fgap v2 composite-blind role mapping allows privilege escalation

A flaw was found in the Fine-Grained Admin Permissions (FGAP v2) feature of Keycloak, an identity and access management solution. The issue occurs when the system checks if a delegated administrator has permission to assign a specific role to a user. Because the check does not look inside composite roles to see what other permissions they contain, an administrator with limited rights can assign a role that secretly includes full administrative control. This allows the attacker to gain complete management access over the entire realm.

Red Hat Build of Keycloak Red Hat Build of Keycloak Red Hat Single Sign-On 7 CVE-2026-96448

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-96448

Red Hat Build of Keycloak

Source reference: /containers/cna/affected/0/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat Build of Keycloak

Source reference: /containers/cna/affected/1/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat Single Sign-On 7

Source reference: /containers/cna/affected/2/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2026-96448
Source reference: /cveMetadata/cveId

Publisher severity

medium

Source reference: /containers/cna/metrics

Event: #2418 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 21:18:13 GMT
Publisher date: Fri, 25 Sep 2026 07:39:51 GMT

Read the original announcement

advisoryOfficial CVE List24 Oct 2026

Keycloak-services: keycloak-services: standard token exchange v2 bypasses mtls holder-of-key binding

Keycloak provides a feature called mTLS holder-of-key binding which ensures that a token can only be used by the client that originally requested it by binding it to their digital certificate. A flaw was discovered where the new Standard Token Exchange V2 feature does not check for this certificate. This allows an attacker with stolen client credentials to obtain a standard, unrestricted token that bypasses these security protections.

Red Hat Build of Keycloak Red Hat Build of Keycloak Red Hat Single Sign-On 7 CVE-2026-97846

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-97846

Red Hat Build of Keycloak

Source reference: /containers/cna/affected/0/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat Build of Keycloak

Source reference: /containers/cna/affected/1/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat Single Sign-On 7

Source reference: /containers/cna/affected/2/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2026-97846
Source reference: /cveMetadata/cveId

Publisher severity

medium

Source reference: /containers/cna/metrics

Event: #2093 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 21:12:55 GMT
Publisher date: Fri, 25 Sep 2026 06:16:38 GMT

Read the original announcement

advisoryOfficial CVE List24 Oct 2026

Keycloak-services: keycloak-services: authorization services policy evaluation endpoint leaks user identity

A flaw was found in the Authorization Services component of Keycloak, an open-source identity and access management solution. The issue occurs in the policy evaluation endpoint, which is used by administrators to test how access policies apply to specific users. Due to missing authorization checks, a delegated administrator with limited viewing privileges can access the full profile and role information of any user in the realm, even if they are not permitted to view user details. This could lead to the exposure of sensitive information such as email addresses and assigned security roles.

Red Hat Build of Keycloak Red Hat Build of Keycloak Red Hat Build of Keycloak Red Hat Single Sign-On 7 CVE-2026-94213

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-94213

Red Hat Build of Keycloak

Source reference: /containers/cna/affected/0/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat Build of Keycloak

Source reference: /containers/cna/affected/1/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat Build of Keycloak

Source reference: /containers/cna/affected/2/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat Single Sign-On 7

Source reference: /containers/cna/affected/3/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2026-94213
Source reference: /cveMetadata/cveId

Publisher severity

medium

Source reference: /containers/cna/metrics

Event: #1997 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 21:11:12 GMT
Publisher date: Mon, 21 Sep 2026 06:03:37 GMT

Read the original announcement

advisoryOfficial CVE List24 Oct 2026

Keycloak-services: keycloak: replay protection bypass leads to unauthorized access via database driver semantics mismatch

A flaw was found in Keycloak. When deployed in stateless mode with MySQL or MariaDB, a mismatch in row-count semantics between the database driver and Keycloak's application logic allows an attacker to bypass replay protection. This vulnerability enables an attacker who intercepts single-use security artifacts, such as JWT client assertions, DPoP proofs, or one-time password (TOTP) codes, to replay them. Successful exploitation grants unauthorized access to the token endpoint or login flow.

Keycloak Red Hat Build of Keycloak Red Hat Build of Keycloak CVE-2026-90997

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-90997

Keycloak

Source reference: /containers/cna/affected/0/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat Build of Keycloak

Source reference: /containers/cna/affected/1/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat Build of Keycloak

Source reference: /containers/cna/affected/2/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2026-90997
Source reference: /cveMetadata/cveId

Publisher severity

high

Source reference: /containers/cna/metrics

Event: #1995 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 21:11:11 GMT
Publisher date: Thu, 17 Sep 2026 18:47:34 GMT

Read the original announcement

advisoryOfficial CVE List24 Oct 2026

Keycloak-services: keycloak-services: uma scope merge across resource owners via resource name collision

A flaw was found in the User-Managed Access (UMA) implementation of Keycloak. The issue occurs in the authorization token endpoint when processing permission tickets. If two different users own resources with the same name, the system incorrectly merges the permissions from both resources when one user requests an authorization token. This allows an attacker to gain access scopes on a victim's resource that were never intended to be shared.

Red Hat Build of Keycloak Red Hat Build of Keycloak Red Hat Build of Keycloak Red Hat Single Sign-On 7 CVE-2026-94217

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-94217

Red Hat Build of Keycloak

Source reference: /containers/cna/affected/0/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat Build of Keycloak

Source reference: /containers/cna/affected/1/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat Build of Keycloak

Source reference: /containers/cna/affected/2/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat Single Sign-On 7

Source reference: /containers/cna/affected/3/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2026-94217
Source reference: /cveMetadata/cveId

Publisher severity

low

Source reference: /containers/cna/metrics

Event: #597 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 20:47:54 GMT
Publisher date: Mon, 21 Sep 2026 06:45:27 GMT

Read the original announcement

advisoryOfficial CVE List24 Oct 2026

Keycloak-services: keycloak-services: generic user update bypasses denied reset-password permission

A flaw was found in the user update mechanism of the Keycloak Admin REST API. When Fine-Grained Admin Permissions are enabled, the system fails to check for specific password reset authorizations during a general user profile update. This allows a delegated administrator, who should be restricted from resetting passwords, to change a user's credentials and take over their account.

Red Hat Build of Keycloak Red Hat Build of Keycloak Red Hat Single Sign-On 7 CVE-2026-97177

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-97177

Red Hat Build of Keycloak

Source reference: /containers/cna/affected/0/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat Build of Keycloak

Source reference: /containers/cna/affected/1/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat Single Sign-On 7

Source reference: /containers/cna/affected/2/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2026-97177
Source reference: /cveMetadata/cveId

Publisher severity

medium

Source reference: /containers/cna/metrics

Event: #585 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 20:47:47 GMT
Publisher date: Thu, 24 Sep 2026 05:47:57 GMT

Read the original announcement

advisoryOfficial CVE List24 Oct 2026

Keycloak-services: keycloak-services: admin rest api role-groups endpoint discloses groups without authorization

A flaw was found in the Admin REST API of Keycloak, an identity and access management solution. The endpoints used to retrieve groups associated with a specific role do not properly check for individual group visibility permissions. This allows a delegated administrator with basic search privileges to view detailed information about all groups assigned to a role, bypassing intended security restrictions that should limit their view to specific groups.

Red Hat Build of Keycloak Red Hat Build of Keycloak Red Hat Single Sign-On 7 CVE-2026-97311

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-97311

Red Hat Build of Keycloak

Source reference: /containers/cna/affected/0/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat Build of Keycloak

Source reference: /containers/cna/affected/1/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat Single Sign-On 7

Source reference: /containers/cna/affected/2/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2026-97311
Source reference: /cveMetadata/cveId

Publisher severity

medium

Source reference: /containers/cna/metrics

Event: #567 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 20:47:35 GMT
Publisher date: Thu, 24 Sep 2026 11:28:39 GMT

Read the original announcement