Red Hat Build Of Keycloak 26 6 7
Monthly
Privilege escalation in Red Hat Build of Keycloak allows an account already holding the realm 'impersonation' role to impersonate a realm administrator and thereby seize full administrative control over that realm, including management of users, clients, and roles. Affected builds are 26.4 before 26.4.16 and 26.6 before 26.6.7. This is an access-gated issue rather than a pre-authentication takeover: the CVSS vector (PR:H) confirms the attacker must be an authenticated, privileged sub-administrator or holder of a compromised delegated-admin credential before exploitation is possible, and no public exploit code or confirmed active exploitation has been identified at time of analysis.
Account lockout in the Red Hat build of Keycloak 26.4 and 26.6 lets an unauthenticated remote attacker deny access to a targeted user by registering that user's username on a trusted external identity provider, triggering a username collision during the first-broker-login flow. Exploitation requires the affected realm to be configured for identity brokering with an external IdP and to perform account linking by username, and the attacker must know or guess the victim's Keycloak username; no credentials or victim interaction are needed. Impact is limited to denial of access for one specific user (CVSS 5.3, AV:N/AC:L/PR:N/UI:N/C:N/I:N/A:L, CWE-287), with no data exposure or account takeover, and no public exploit has been identified at time of analysis. Fixed versions are Red Hat build of Keycloak 26.4.16 and 26.6.7.
Privilege escalation in Red Hat Build of Keycloak allows an account already holding the realm 'impersonation' role to impersonate a realm administrator and thereby seize full administrative control over that realm, including management of users, clients, and roles. Affected builds are 26.4 before 26.4.16 and 26.6 before 26.6.7. This is an access-gated issue rather than a pre-authentication takeover: the CVSS vector (PR:H) confirms the attacker must be an authenticated, privileged sub-administrator or holder of a compromised delegated-admin credential before exploitation is possible, and no public exploit code or confirmed active exploitation has been identified at time of analysis.
Account lockout in the Red Hat build of Keycloak 26.4 and 26.6 lets an unauthenticated remote attacker deny access to a targeted user by registering that user's username on a trusted external identity provider, triggering a username collision during the first-broker-login flow. Exploitation requires the affected realm to be configured for identity brokering with an external IdP and to perform account linking by username, and the attacker must know or guess the victim's Keycloak username; no credentials or victim interaction are needed. Impact is limited to denial of access for one specific user (CVSS 5.3, AV:N/AC:L/PR:N/UI:N/C:N/I:N/A:L, CWE-287), with no data exposure or account takeover, and no public exploit has been identified at time of analysis. Fixed versions are Red Hat build of Keycloak 26.4.16 and 26.6.7.