CVE-2026-18573

A flaw was found in the keycloak-services component of Keycloak, which is used for managing authentication and authorization flows. The issue occurs when a realm administrator configures client policies to enforce specific authentication requirements on confidential clients. Due to improper...

PT-2026-67138

Name of the Vulnerable Software and Affected Versions Keycloak affected versions not specified Description A flaw in the keycloak-services component, used for managing authentication and authorization flows, allows a bypass of client access-type policy conditions. When a realm administrator...

keycloak: Keycloak: Privilege escalation via improper scope mapping enforcement

A flaw was found in Keycloak's Fine-Grained Admin Permissions FGAPv2 feature. An administrator with limited client management permissions can exploit this vulnerability to assign any realm role, including highly privileged roles, to a client's scope mapping. This bypasses intended security...