Skip to content
CVE PROGRAM SOURCE RECORD7.4 High

CVE-2026-4282

Keycloak: keycloak: privilege escalation via forged authorization codes due to singleuseobjectprovider isolation flaw

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
redhat

Description

A flaw was found in Keycloak. The SingleUseObjectProvider, a global key-value store, lacks proper type and namespace isolation. This vulnerability allows an unauthenticated attacker to forge authorization codes. Successful exploitation can lead to the creation of admin-capable access tokens, resulting in privilege escalation.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Red Hat Red Hat build of Keycloak 26.2

Default version status: affected

  • 26.2.15-1 to < *unaffected

Red Hat Red Hat build of Keycloak 26.2

Default version status: affected

  • 26.2-18 to < *unaffected

Red Hat Red Hat build of Keycloak 26.2

Default version status: affected

  • 26.2-18 to < *unaffected

Red Hat Red Hat build of Keycloak 26.2.15

Default version status: unaffected

Red Hat Red Hat build of Keycloak 26.4

Default version status: affected

  • 26.4.11-1 to < *unaffected

Red Hat Red Hat build of Keycloak 26.4

Default version status: affected

  • 26.4-14 to < *unaffected

Red Hat Red Hat build of Keycloak 26.4

Default version status: affected

  • 26.4-14 to < *unaffected

Red Hat Red Hat build of Keycloak 26.4.11

Default version status: unaffected

References