EUVD-2026-18212
GHSA-h4wv-g838-66g3
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSend POST request to OIDC token endpoint
-
DeliveryInclude excessively long scope parameter
-
ExploitTrigger high resource consumption
-
ExecutionKeycloak server becomes unresponsive
-
ImpactDenial of Service condition achieved
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Excessive platform resource consumption
|
| Exploitation Conditions | Remote unauthenticated attacker sends POST request with excessively long scope parameter to Keycloak OIDC token endpoint. No victim interaction required. Affects all Keycloak versions with OIDC token endpoint enabled (default configuration). |
| Impact | This vulnerability presents moderate real-world risk despite its CVSS 7.5 (High) score. The attack vector is highly favorable for attackers: network-accessible (AV:N), low complexity (AC:L), requiring no privileges (PR:N) or user interaction (UI:N), and exclusively impacting availability (A:H). However, several factors temper the urgency. No confirmed active exploitation exists (not present in CISA KEV catalog), and no public exploit code is identified at time of analysis. EPSS data is not provided, but typical unauthenticated DoS vulnerabilities against public authentication endpoints show moderate exploitation probability due to ease of discovery and exploitation. The SSVC technical impact is limited to availability disruption without confidentiality or integrity compromise-this is strictly a DoS, not a data breach vector. Automatable: likely yes, as the attack requires only HTTP POST requests with manipulated parameters. Organizations running internet-facing Keycloak instances should prioritize patching, as authentication infrastructure DoS directly impacts business operations and user access. However, this ranks below actively exploited vulnerabilities or those enabling data exfiltration. Risk is highest for multi-tenant environments or high-traffic identity providers where service availability is critical. |
| Exploit ScenarioDerived | An unauthenticated attacker identifies a publicly accessible Keycloak server and locates the OpenID Connect token endpoint (typically at /realms/{realm}/protocol/openid-connect/token). The attacker crafts a malicious POST request with a valid client_id and grant_type, but injects an excessively long string (potentially megabytes of repeated scope values) into the scope parameter. Upon receiving the request, the Keycloak server attempts to parse and validate the malformed scope parameter, consuming excessive CPU cycles and memory in string processing loops. By sending multiple concurrent requests or sustaining a low-rate attack, the attacker exhausts available server resources (thread pools, memory, CPU), causing legitimate authentication requests to time out or fail. This results in a complete Denial of Service for users attempting to authenticate through the affected Keycloak instance, disrupting access to all applications relying on it for identity management. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 02, 2026
Denial of Service in Red Hat Build of Keycloak allows unauthenticated remote attackers to exhaust server resources by submitting specially crafted POST requests with excessively long scope parameters to the OpenID Connect token endpoint. No public exploit identified at time of analysis, but CVSS 7.5 (High) with network attack vector and low complexity indicates straightforward exploitation. Authentication requirements: unauthenticated (CVSS PR:N). The vulnerability stems from improper resource management (CWE-1050), enabling attackers to cause prolonged processing times and service disruption without any authentication or user interaction.
RemediationAI
Organizations running affected Red Hat Build of Keycloak versions should immediately consult the official Red Hat security advisory at https://access.redhat.com/security/cve/CVE-2026-4634 for patched versions and upgrade instructions. The advisory linked through Red Hat Bugzilla (https://bugzilla.redhat.com/show_bug.cgi?id=2450250) may contain additional technical details and timelines. Patch availability from vendor advisory: confirmed available per Red Hat security portal. Until patching is complete, consider implementing temporary mitigations such as rate limiting on the OIDC token endpoint using a Web Application Firewall (WAF) or reverse proxy, restricting maximum POST body size to reject abnormally large requests, or applying network-level access controls to limit token endpoint exposure only to trusted clients if architecturally feasible. Monitor server resource utilization and token endpoint response times for anomalous activity indicating exploitation attempts. Test patches in non-production environments before deploying to production identity infrastructure.
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in maven
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This vulnerability affects the OpenID Connect (OIDC) token endpoint in Red Hat Build of Keycloak, an open-source identity and access management solution. The OIDC token endpoint processes OAuth 2.0/OIDC authentication flows, including scope parameter validation during token requests. The root cause falls under CWE-1050 (Excessive Platform Resource Consumption within a Loop or Recursion), indicating the server fails to properly limit or validate the length of scope parameters before processing. When an attacker submits a POST request with an abnormally large scope string, the server attempts to parse and process the entire payload without adequate bounds checking or early termination logic. This triggers resource-intensive operations-likely string parsing, memory allocation, or scope validation loops-that monopolize CPU cycles, memory, or thread pools. The affected CPE (cpe:2.3:a:red_hat:red_hat_build_of_keycloak) indicates this affects Red Hat's packaged distribution of Keycloak, though the underlying issue may exist in upstream Keycloak as well.
Know when Red Hat Build Of Keycloak gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
Lifecycle Timeline
2DescriptionCVE.org
A flaw was found in Keycloak. An unauthenticated attacker can exploit this vulnerability by sending a specially crafted POST request with an excessively long scope parameter to the OpenID Connect (OIDC) token endpoint. This leads to high resource consumption and prolonged processing times, ultimately resulting in a Denial of Service (DoS) for the Keycloak server.
Blast Radius
ecosystem impact- 54 maven packages depend on org.keycloak:keycloak-services (26 direct, 28 indirect)
Ecosystem-wide dependent count for version 26.5.7.
Executive ViewAI
Red Hat Build of Keycloak contains a remote denial-of-service vulnerability (CVE-2026-4634, CVSS 7.5) that allows unauthenticated attackers to exhaust server resources and disrupt authentication services by submitting malformed token requests. Any organization using Keycloak for identity management faces potential service unavailability, preventing legitimate users from authenticating to dependent applications and systems.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Deploy Web Application Firewall (WAF) rules to block POST requests with excessively large scope parameter values to the token endpoint; (2) Implement strict request size limits and connection timeouts at load balancer/reverse proxy layer; (3) Enable rate limiting per source IP on authentication endpoints; (4) Configure alerting for abnormal token endpoint traffic patterns and processing delays; (5) Maintain authentication service redundancy to absorb resource exhaustion attempts. These controls reduce but do not eliminate risk-patch deployment is essential.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Affected Products (CPE)CVE.org
Related Vulnerabilities in Keycloak Authentication and Authorization Bypass
View all 5More in Red Hat Build Of Keycloak
View allAccount takeover in Red Hat Build of Keycloak allows an unauthenticated attacker to abuse the reset-credentials flow in
Account takeover in Keycloak (Red Hat build of Keycloak, Red Hat Single Sign-On 7) arises because the IdP-initiated SAML
Authentication bypass in Red Hat Build of Keycloak (and Red Hat Single Sign-On 7) lets an unauthenticated attacker forge
Privilege escalation in Red Hat Build of Keycloak's Dynamic Client Registration (DCR) grants an attacker with low-privil
Mismatched handling of the HTTP/1 absolute-form request authority in Red Hat build of Quarkus and other affected Red Hat
Authorization bypass in the Keycloak Policy Enforcer allows any authenticated user to circumvent all enforced access con
URI normalization bypass in Keycloak's Authorization Services PathMatcher allows authenticated low-privilege users to re
Privilege escalation in Keycloak's Dynamic Client Registration (DCR) component allows attackers with standard user accou
Token exchange in Keycloak bypasses Google Workspace domain allowlist restrictions, enabling any valid Google account ho
Signature-verification bypass in Keycloak (and Red Hat's Keycloak-based products such as Red Hat Single Sign-On 7 and Re
Tenant-restriction bypass in Keycloak's Microsoft identity provider integration allows attackers holding any valid Micro
Session hijacking via SAML assertion replay in Keycloak's SAML broker component allows adjacent-network attackers to aut
Exploit-DB