CVE-2026-120984

A flaw in the Keycloak server's client management component allows an authenticated attacker with client management permissions to achieve arbitrary code execution . The root cause is a failure to properly clear an internal session attribute during the creation or import of a client with authoriz...