EUVD-2026-18210
GHSA-rx66-hj7g-28h7
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V15 - Secure Coding and Architecture Component isolation
|
| Impact | While the CVSS score of 5.3 appears moderate, the attack vector (network-accessible), integrity impact (high), and authentication bypass classification indicate meaningful real-world risk. The high attack complexity (AC:H) and required user interaction (UI:R) significantly reduce practical exploitability, suggesting this is not a trivial remote attack. The CVSS score reflects these constraints accurately. Exploitation requires an attacker to craft a specific request to delete legitimate single-use entries, then socially engineer or wait for a user to attempt legitimate token usage, making this a multi-step attack. The integrity impact (I:H) is significant because successful exploitation directly compromises account security through token replay. No KEV confirmation or public POC availability was noted in the provided intelligence, suggesting this remains a lower-priority patch candidate compared to unauthenticated, low-complexity vulnerabilities, though the authentication bypass classification warrants timely remediation. |
| Exploit ScenarioDerived | An attacker discovers or infers the namespace structure of Keycloak's SingleUseObjectProvider and crafts a request to delete password reset tokens for a target user. When the victim initiates a legitimate password reset workflow, they receive a reset link, but when they attempt to use it, the token has already been deleted by the attacker, forcing them to request a new one. Alternatively, the attacker could delete tokens preemptively and then exploit a race condition or timing window to insert their own password reset request, potentially gaining account access. The high attack complexity and required user interaction suggest this attack is not trivial but is feasible against high-value targets. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 02, 2026
Keycloak's SingleUseObjectProvider lacks proper type and namespace isolation, allowing unauthenticated remote attackers with user interaction to delete arbitrary single-use entries and replay consumed action tokens such as password reset links, leading to account compromise. The vulnerability requires user interaction (UI:R) and high attack complexity (AC:H), resulting in a CVSS score of 5.3. No public exploit code or active exploitation has been confirmed at time of analysis.
RemediationAI
Organizations running Red Hat Build of Keycloak should apply the vendor-released patch corresponding to their deployed version as soon as practical. Consult Red Hat's official security advisory at https://access.redhat.com/security/cve/CVE-2026-4325 for specific patched version numbers and upgrade instructions. Interim mitigations should focus on restricting access to password reset and account recovery flows to authenticated, trusted networks if operationally feasible, and monitoring for unusual token consumption patterns. Organizations should prioritize patching authentication-critical systems first, given the potential for account compromise through token replay attacks.
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in maven
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Keycloak's SingleUseObjectProvider is a global key-value store mechanism responsible for managing single-use tokens and action tokens, including password reset and email verification links. The vulnerability stems from improper isolation of token types and namespaces (CWE-653: Unsupported Feature in Generator), allowing attackers to manipulate the store without proper access controls or validation. This design flaw enables an attacker to enumerate and delete entries belonging to other users or sessions, effectively invalidating the single-use constraint that these tokens are designed to enforce. The affected component is present in Red Hat Build of Keycloak across multiple versions as indicated by the wildcard CPE specification.
Know when Red Hat Build Of Keycloak gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
Lifecycle Timeline
2DescriptionCVE.org
A flaw was found in Keycloak. The SingleUseObjectProvider, a global key-value store, lacks proper type and namespace isolation. This vulnerability allows an attacker to delete arbitrary single-use entries, which can enable the replay of consumed action tokens, such as password reset links. This could lead to unauthorized access or account compromise.
Blast Radius
ecosystem impact- 54 maven packages depend on org.keycloak:keycloak-services (26 direct, 28 indirect)
Ecosystem-wide dependent count for version 26.5.7.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Affected Products (CPE)CVE.org
Related Vulnerabilities in Keycloak Authentication and Authorization Bypass
View all 5More in Red Hat Build Of Keycloak
View allAccount takeover in Red Hat Build of Keycloak allows an unauthenticated attacker to abuse the reset-credentials flow in
Account takeover in Keycloak (Red Hat build of Keycloak, Red Hat Single Sign-On 7) arises because the IdP-initiated SAML
Authentication bypass in Red Hat Build of Keycloak (and Red Hat Single Sign-On 7) lets an unauthenticated attacker forge
Privilege escalation in Red Hat Build of Keycloak's Dynamic Client Registration (DCR) grants an attacker with low-privil
Mismatched handling of the HTTP/1 absolute-form request authority in Red Hat build of Quarkus and other affected Red Hat
Authorization bypass in the Keycloak Policy Enforcer allows any authenticated user to circumvent all enforced access con
URI normalization bypass in Keycloak's Authorization Services PathMatcher allows authenticated low-privilege users to re
Privilege escalation in Keycloak's Dynamic Client Registration (DCR) component allows attackers with standard user accou
Token exchange in Keycloak bypasses Google Workspace domain allowlist restrictions, enabling any valid Google account ho
Signature-verification bypass in Keycloak (and Red Hat's Keycloak-based products such as Red Hat Single Sign-On 7 and Re
Tenant-restriction bypass in Keycloak's Microsoft identity provider integration allows attackers holding any valid Micro
Session hijacking via SAML assertion replay in Keycloak's SAML broker component allows adjacent-network attackers to aut
Exploit-DB