EUVD-2026-94213
GHSA-4276-jw29-xwhr
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N
Network-reachable SMTP traffic (AV:N) but requires an active man-in-the-middle position and STARTTLS tampering (AC:H); no auth needed (PR:N); credential/content disclosure drives C:H with minor I:L and no availability impact.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
Lifecycle Timeline
2DescriptionCVE.org
A flaw was found in the SMTP email configuration handling of the keycloak-services component. When the STARTTLS option is enabled, Keycloak fails to strictly enforce an encrypted connection, allowing it to fall back to unencrypted communication if the encryption request is tampered with. An attacker who can intercept network traffic can exploit this to capture sensitive email credentials and message content in plain text.
AnalysisAI
Keycloak's SMTP email configuration can silently fall back to unencrypted communication when STARTTLS is enabled, allowing an attacker who can intercept and tamper with traffic between the Keycloak server and its mail relay to capture SMTP credentials and email message content in cleartext. Affected deployments include Red Hat Build of Keycloak and Red Hat Single Sign-On 7 (CVSS 6.5, AV:N/AC:H/PR:N/UI:N), but exploitation is conditional: it requires a man-in-the-middle position on the SMTP path and an instance configured for opportunistic STARTTLS rather than implicit TLS. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that Keycloak's SMTP email configuration has the STARTTLS option enabled (opportunistic TLS) rather than enforced implicit TLS, and that the attacker can actively intercept and modify traffic on the network path between the Keycloak server and its SMTP mail server. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine but conditional confidentiality issue rather than a drop-everything priority. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch or fixed version is identified in the available data at time of analysis; monitor https://access.redhat.com/security/cve/CVE-2026-107121 and https://bugzilla.redhat.com/show_bug.cgi?id=2547296 for Red Hat errata covering Red Hat Build of Keycloak and Red Hat Single Sign-On 7. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Red Hat Build Of Keycloak
View allAccount takeover in Red Hat Build of Keycloak allows an unauthenticated attacker to abuse the reset-credentials flow in
Account takeover in Keycloak (Red Hat build of Keycloak, Red Hat Single Sign-On 7) arises because the IdP-initiated SAML
Authentication bypass in Red Hat Build of Keycloak (and Red Hat Single Sign-On 7) lets an unauthenticated attacker forge
Privilege escalation in Red Hat Build of Keycloak's Dynamic Client Registration (DCR) grants an attacker with low-privil
Mismatched handling of the HTTP/1 absolute-form request authority in Red Hat build of Quarkus and other affected Red Hat
Authorization bypass in the Keycloak Policy Enforcer allows any authenticated user to circumvent all enforced access con
URI normalization bypass in Keycloak's Authorization Services PathMatcher allows authenticated low-privilege users to re
Privilege escalation in Keycloak's Dynamic Client Registration (DCR) component allows attackers with standard user accou
Token exchange in Keycloak bypasses Google Workspace domain allowlist restrictions, enabling any valid Google account ho
Signature-verification bypass in Keycloak (and Red Hat's Keycloak-based products such as Red Hat Single Sign-On 7 and Re
Tenant-restriction bypass in Keycloak's Microsoft identity provider integration allows attackers holding any valid Micro
Session hijacking via SAML assertion replay in Keycloak's SAML broker component allows adjacent-network attackers to aut
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today