EUVD-2026-18212
GHSA-h4wv-g838-66g3
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Lifecycle Timeline
5Blast Radius
ecosystem impact- 53 maven packages depend on org.keycloak:keycloak-services (25 direct, 28 indirect)
Ecosystem-wide dependent count for version 26.5.7.
DescriptionCVE.org
A flaw was found in Keycloak. An unauthenticated attacker can exploit this vulnerability by sending a specially crafted POST request with an excessively long scope parameter to the OpenID Connect (OIDC) token endpoint. This leads to high resource consumption and prolonged processing times, ultimately resulting in a Denial of Service (DoS) for the Keycloak server.
AnalysisAI
Denial of Service in Red Hat Build of Keycloak allows unauthenticated remote attackers to exhaust server resources by submitting specially crafted POST requests with excessively long scope parameters to the OpenID Connect token endpoint. No public exploit identified at time of analysis, but CVSS 7.5 (High) with network attack vector and low complexity indicates straightforward exploitation. Authentication requirements: unauthenticated (CVSS PR:N). The vulnerability stems from improper resource management (CWE-1050), enabling attackers to cause prolonged processing times and service disruption without any authentication or user interaction.
Technical ContextAI
This vulnerability affects the OpenID Connect (OIDC) token endpoint in Red Hat Build of Keycloak, an open-source identity and access management solution. The OIDC token endpoint processes OAuth 2.0/OIDC authentication flows, including scope parameter validation during token requests. The root cause falls under CWE-1050 (Excessive Platform Resource Consumption within a Loop or Recursion), indicating the server fails to properly limit or validate the length of scope parameters before processing. When an attacker submits a POST request with an abnormally large scope string, the server attempts to parse and process the entire payload without adequate bounds checking or early termination logic. This triggers resource-intensive operations-likely string parsing, memory allocation, or scope validation loops-that monopolize CPU cycles, memory, or thread pools. The affected CPE (cpe:2.3:a:red_hat:red_hat_build_of_keycloak) indicates this affects Red Hat's packaged distribution of Keycloak, though the underlying issue may exist in upstream Keycloak as well.
RemediationAI
Organizations running affected Red Hat Build of Keycloak versions should immediately consult the official Red Hat security advisory at https://access.redhat.com/security/cve/CVE-2026-4634 for patched versions and upgrade instructions. The advisory linked through Red Hat Bugzilla (https://bugzilla.redhat.com/show_bug.cgi?id=2450250) may contain additional technical details and timelines. Patch availability from vendor advisory: confirmed available per Red Hat security portal. Until patching is complete, consider implementing temporary mitigations such as rate limiting on the OIDC token endpoint using a Web Application Firewall (WAF) or reverse proxy, restricting maximum POST body size to reject abnormally large requests, or applying network-level access controls to limit token endpoint exposure only to trusted clients if architecturally feasible. Monitor server resource utilization and token endpoint response times for anomalous activity indicating exploitation attempts. Test patches in non-production environments before deploying to production identity infrastructure.
More in Red Hat Build Of Keycloak
View allAuthorization bypass in the Keycloak Policy Enforcer allows any authenticated user to circumvent all enforced access con
Signature-verification bypass in Keycloak (and Red Hat's Keycloak-based products such as Red Hat Single Sign-On 7 and Re
Open redirect in Red Hat build of Keycloak permits remote attackers to send victims to attacker-controlled hosts by abus
Identity linking bypass in Red Hat build of Keycloak allows an attacker controlling a second account on the same upstrea
Authenticated users with uma_protection role in Red Hat Keycloak can bypass User-Managed Access policy validation to gai
Privilege escalation in Keycloak (Red Hat Build of Keycloak) lets an authenticated delegated admin with management right
Denial of service in Red Hat build of Keycloak allows remote unauthenticated attackers to exhaust CPU and worker threads
Session fixation in Keycloak's login-actions endpoints allows remote attackers to hijack authenticated sessions and take
Authorization code forgery in Red Hat Keycloak enables unauthenticated attackers to escalate privileges to admin-level a
Stored Cross-Site Scripting in Red Hat Build of Keycloak lets an authenticated administrator with `manage-client` permis
Open redirect in Red Hat Build of Keycloak allows authenticated attackers with control over another path on the same web
Privilege escalation in Keycloak's Fine-Grained Admin Permissions v2 (FGAPv2) allows an administrator with only limited
Same technique Denial Of Service
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today