EUVD-2026-18212
GHSA-h4wv-g838-66g3
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
Lifecycle Timeline
5Blast Radius
ecosystem impact- 54 maven packages depend on org.keycloak:keycloak-services (26 direct, 28 indirect)
Ecosystem-wide dependent count for version 26.5.7.
DescriptionCVE.org
A flaw was found in Keycloak. An unauthenticated attacker can exploit this vulnerability by sending a specially crafted POST request with an excessively long scope parameter to the OpenID Connect (OIDC) token endpoint. This leads to high resource consumption and prolonged processing times, ultimately resulting in a Denial of Service (DoS) for the Keycloak server.
AnalysisAI
Denial of Service in Red Hat Build of Keycloak allows unauthenticated remote attackers to exhaust server resources by submitting specially crafted POST requests with excessively long scope parameters to the OpenID Connect token endpoint. No public exploit identified at time of analysis, but CVSS 7.5 (High) with network attack vector and low complexity indicates straightforward exploitation. Authentication requirements: unauthenticated (CVSS PR:N). The vulnerability stems from improper resource management (CWE-1050), enabling attackers to cause prolonged processing times and service disruption without any authentication or user interaction.
Technical ContextAI
This vulnerability affects the OpenID Connect (OIDC) token endpoint in Red Hat Build of Keycloak, an open-source identity and access management solution. The OIDC token endpoint processes OAuth 2.0/OIDC authentication flows, including scope parameter validation during token requests. The root cause falls under CWE-1050 (Excessive Platform Resource Consumption within a Loop or Recursion), indicating the server fails to properly limit or validate the length of scope parameters before processing. When an attacker submits a POST request with an abnormally large scope string, the server attempts to parse and process the entire payload without adequate bounds checking or early termination logic. This triggers resource-intensive operations-likely string parsing, memory allocation, or scope validation loops-that monopolize CPU cycles, memory, or thread pools. The affected CPE (cpe:2.3:a:red_hat:red_hat_build_of_keycloak) indicates this affects Red Hat's packaged distribution of Keycloak, though the underlying issue may exist in upstream Keycloak as well.
RemediationAI
Organizations running affected Red Hat Build of Keycloak versions should immediately consult the official Red Hat security advisory at https://access.redhat.com/security/cve/CVE-2026-4634 for patched versions and upgrade instructions. The advisory linked through Red Hat Bugzilla (https://bugzilla.redhat.com/show_bug.cgi?id=2450250) may contain additional technical details and timelines. Patch availability from vendor advisory: confirmed available per Red Hat security portal. Until patching is complete, consider implementing temporary mitigations such as rate limiting on the OIDC token endpoint using a Web Application Firewall (WAF) or reverse proxy, restricting maximum POST body size to reject abnormally large requests, or applying network-level access controls to limit token endpoint exposure only to trusted clients if architecturally feasible. Monitor server resource utilization and token endpoint response times for anomalous activity indicating exploitation attempts. Test patches in non-production environments before deploying to production identity infrastructure.
More in Red Hat Build Of Keycloak
View allAccount takeover in Red Hat Build of Keycloak allows an unauthenticated attacker to abuse the reset-credentials flow in
Account takeover in Keycloak (Red Hat build of Keycloak, Red Hat Single Sign-On 7) arises because the IdP-initiated SAML
Authentication bypass in Red Hat Build of Keycloak (and Red Hat Single Sign-On 7) lets an unauthenticated attacker forge
Privilege escalation in Red Hat Build of Keycloak's Dynamic Client Registration (DCR) grants an attacker with low-privil
Authorization bypass in the Keycloak Policy Enforcer allows any authenticated user to circumvent all enforced access con
URI normalization bypass in Keycloak's Authorization Services PathMatcher allows authenticated low-privilege users to re
Privilege escalation in Keycloak's Dynamic Client Registration (DCR) component allows attackers with standard user accou
Token exchange in Keycloak bypasses Google Workspace domain allowlist restrictions, enabling any valid Google account ho
Signature-verification bypass in Keycloak (and Red Hat's Keycloak-based products such as Red Hat Single Sign-On 7 and Re
Tenant-restriction bypass in Keycloak's Microsoft identity provider integration allows attackers holding any valid Micro
Session hijacking via SAML assertion replay in Keycloak's SAML broker component allows adjacent-network attackers to aut
Open redirect in Red Hat build of Keycloak permits remote attackers to send victims to attacker-controlled hosts by abus
Same technique Denial Of Service
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today