Red Hat Build Of Keycloak 26 6
Monthly
Privilege escalation in Red Hat Build of Keycloak allows an account already holding the realm 'impersonation' role to impersonate a realm administrator and thereby seize full administrative control over that realm, including management of users, clients, and roles. Affected builds are 26.4 before 26.4.16 and 26.6 before 26.6.7. This is an access-gated issue rather than a pre-authentication takeover: the CVSS vector (PR:H) confirms the attacker must be an authenticated, privileged sub-administrator or holder of a compromised delegated-admin credential before exploitation is possible, and no public exploit code or confirmed active exploitation has been identified at time of analysis.
Signature-verification bypass in Keycloak (and Red Hat's Keycloak-based products such as Red Hat Single Sign-On 7 and Red Hat Build of Keycloak 26.6/26.6.4) lets an attacker holding valid client credentials abuse a JWT algorithm-confusion weakness in the JWT Authorization Grant flow to forge client assertions and mint unauthorized access tokens. The forged tokens allow impersonation of any federated user tied to the affected Identity Provider, yielding unauthorized access and potential privilege escalation. There is no public exploit identified at time of analysis and the issue is not on CISA KEV; Red Hat rates it 8.1 (High).
Account lockout in the Red Hat build of Keycloak 26.4 and 26.6 lets an unauthenticated remote attacker deny access to a targeted user by registering that user's username on a trusted external identity provider, triggering a username collision during the first-broker-login flow. Exploitation requires the affected realm to be configured for identity brokering with an external IdP and to perform account linking by username, and the attacker must know or guess the victim's Keycloak username; no credentials or victim interaction are needed. Impact is limited to denial of access for one specific user (CVSS 5.3, AV:N/AC:L/PR:N/UI:N/C:N/I:N/A:L, CWE-287), with no data exposure or account takeover, and no public exploit has been identified at time of analysis. Fixed versions are Red Hat build of Keycloak 26.4.16 and 26.6.7.
Privilege escalation in Red Hat Build of Keycloak allows an account already holding the realm 'impersonation' role to impersonate a realm administrator and thereby seize full administrative control over that realm, including management of users, clients, and roles. Affected builds are 26.4 before 26.4.16 and 26.6 before 26.6.7. This is an access-gated issue rather than a pre-authentication takeover: the CVSS vector (PR:H) confirms the attacker must be an authenticated, privileged sub-administrator or holder of a compromised delegated-admin credential before exploitation is possible, and no public exploit code or confirmed active exploitation has been identified at time of analysis.
Signature-verification bypass in Keycloak (and Red Hat's Keycloak-based products such as Red Hat Single Sign-On 7 and Red Hat Build of Keycloak 26.6/26.6.4) lets an attacker holding valid client credentials abuse a JWT algorithm-confusion weakness in the JWT Authorization Grant flow to forge client assertions and mint unauthorized access tokens. The forged tokens allow impersonation of any federated user tied to the affected Identity Provider, yielding unauthorized access and potential privilege escalation. There is no public exploit identified at time of analysis and the issue is not on CISA KEV; Red Hat rates it 8.1 (High).
Account lockout in the Red Hat build of Keycloak 26.4 and 26.6 lets an unauthenticated remote attacker deny access to a targeted user by registering that user's username on a trusted external identity provider, triggering a username collision during the first-broker-login flow. Exploitation requires the affected realm to be configured for identity brokering with an external IdP and to perform account linking by username, and the attacker must know or guess the victim's Keycloak username; no credentials or victim interaction are needed. Impact is limited to denial of access for one specific user (CVSS 5.3, AV:N/AC:L/PR:N/UI:N/C:N/I:N/A:L, CWE-287), with no data exposure or account takeover, and no public exploit has been identified at time of analysis. Fixed versions are Red Hat build of Keycloak 26.4.16 and 26.6.7.