CVE-2026-4282

Published Apr 2, 2026

Last updated a month ago

CVSS high 7.4

Overview

AI description

Automated description summarized from trusted sources.

CVE-2026-4282 describes a privilege escalation vulnerability found in Keycloak, an open-source identity and access management solution. The flaw resides within Keycloak's SingleUseObjectProvider component, which functions as a global key-value store for single-use tokens like authorization codes. The vulnerability stems from an improper isolation or compartmentalization of types and namespaces within this provider. This deficiency allows an unauthenticated attacker to forge authorization codes. Successful exploitation of this flaw can lead to the creation of access tokens with administrative capabilities.

Description
A flaw was found in Keycloak. The SingleUseObjectProvider, a global key-value store, lacks proper type and namespace isolation. This vulnerability allows an unauthenticated attacker to forge authorization codes. Successful exploitation can lead to the creation of admin-capable access tokens, resulting in privilege escalation.
Source
secalert@redhat.com
NVD status
Modified
Products
build_of_keycloak

Risk scores

CVSS 3.1

Type
Secondary
Base score
7.4
Impact score
5.2
Exploitability score
2.2
Vector string
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Severity
HIGH

Weaknesses

secalert@redhat.com
CWE-653
0b0ca135-0b70-47e7-9f44-1890c2a1c46c
CWE-653

Social media

Hype score
Not currently trending

  1. #Keycloak pwnage, all public. 1: CVE-2026-4282 forges admin tokens unauth 2: view-clients leaks every client secret, all versions, open #49220 (PoC: https://t.co/cHWnrejmtR) 3: restart revives rotated refresh tokens, CVE-2026-9802 Not every vuln has a CVE https://t.co/ishDz8aqrN

    @kmkz_security

    24 Jun 2026

    18519 Impressions

    36 Retweets

    166 Likes

    142 Bookmarks

    3 Replies

    0 Quotes

Configurations

Related CVEs

  1. A flaw was found in the SAML broker component of Keycloak, an identity and access management solution. When configured as a SAML broker using the IdP-Initiated flow, Keycloak fails to enforce the OneTimeUse condition in SAML assertions. This allows an attacker who captures a valid, unused assertion to replay it multiple times. Successful exploitation could allow an attacker to hijack a user's session and gain unauthorized access to the system as that user.•CVE-2026-18967
  2. A flaw was found in the SAML broker component of Keycloak, which is used to manage identity federation and user authentication. The issue occurs because the IdP-initiated Single Sign-On endpoint fails to check if a provider is restricted to account linking only. This allows an attacker with control over a linked upstream identity to bypass login restrictions and gain full access to a local user account.•CVE-2026-16442
  3. A flaw was found in Keycloak's Dynamic Client Registration (DCR) security policy management. The "Allowed Protocol Mapper Types" policy, which restricts which types of data mappers a client can use, fails to re-validate the mapper type during a client update if the mapper's configuration remains unchanged. An attacker with client registration privileges can exploit this by first registering an allowed mapper type with a malicious configuration and then swapping it for a restricted, high-privilege mapper type (such as one that hardcodes administrative roles). This allows the attacker to gain full administrative access to the Keycloak realm.•CVE-2026-15572
  4. A flaw was found in the Dynamic Client Registration (DCR) component of Keycloak, an identity and access management solution. The default DCR policy fails to properly validate the claim path for User Property mappers, allowing them to write values to sensitive internal claim locations. An attacker with a standard user account and a limited Initial Access Token can exploit this to forge administrative roles in their access token. This allows the attacker to take over other clients, steal confidential secrets, and potentially gain full administrative control over the realm.•CVE-2026-16102
  5. A flaw was found in the user-event metrics recording of Keycloak. When metrics are enabled, the system records raw error messages from failed account operations as Prometheus metric labels. Because these error messages can include user-supplied input like nonexistent client IDs, an authenticated user can create a massive number of unique metric entries, eventually exhausting system memory and causing the service to crash or become unavailable.•CVE-2026-16100

References

Sources include official advisories and independent security research.