CVE-2026-9801: Improper Validation of Specified Quantity in Input

A flaw was found in Keycloak. A remote attacker with high privileges, such as a realm administrator configuring a malicious Lightweight Directory Access Protocol LDAP server or an attacker compromising an upstream LDAP server, could exploit this vulnerability. By sending a malformed LDAP password...

CVE-2026-9792: Improper Handling of Insufficient Permissions or Privileges

A flaw was found in Keycloak's Client Policies, specifically within the org.keycloak.protocol.oidc component. When certain condition providers client-type, client-roles, client-attributes, client-scopes are used to enforce security restrictions, the reject-ropc-grant executor is silently bypassed...

PT-2026-55095

A flaw was found in Keycloak. An authenticated user with existing organization membership can exploit this flaw by accessing user-facing APIs, such as the account API or by requesting an OpenID Connect OIDC token with the 'organization' scope. This allows organization metadata to be disclosed in...

PT-2026-44186

Name of the Vulnerable Software and Affected Versions Keycloak affected versions not specified Description A flaw exists in the Fine-Grained Admin Permissions FGAPv2 feature. An administrator with limited client management permissions can assign any realm role, including highly privileged ones, t...

PT-2026-55091

A flaw was found in Keycloak's Client Policies, specifically within the org.keycloak.protocol.oidc component. When certain condition providers client-type, client-roles, client-attributes, client-scopes are used to enforce security restrictions, the reject-ropc-grant executor is silently bypassed...

Keycloak 安全漏洞

Keycloak is an open-source identity and access management solution developed by Keycloak. There is a security vulnerability in Keycloak. This vulnerability stems from administrators with limited client management privileges being able to exploit the loophole in the fine-grained administrator...

CVE-2026-9795: Incorrect Privilege Assignment

A flaw was found in Keycloak's Fine-Grained Admin Permissions FGAPv2 feature. An administrator with limited client management permissions can exploit this vulnerability to assign any realm role, including highly privileged roles, to a client's scope mapping. This bypasses intended security...

Keycloak 安全漏洞

Keycloak is an open-source identity and access management solution developed by Keycloak. Keycloak has a security vulnerability that stems from the org.keycloak.protocol.oidc component. When certain conditions are met, the reject-ropc-grant executor is silently bypassed, allowing unauthenticated...

PT-2026-55109

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-32h4-44jj-c5vx. This link is maintained to preserve external references. Original Description A flaw was found in Keycloak's Fine-Grained Admin Permissions FGAPv2 feature. An administrator with limited client...

CVE-2026-9791: Incorrect Authorization

A flaw was found in Keycloak. An authenticated user with existing organization membership can exploit this flaw by accessing user-facing APIs, such as the account API or by requesting an OpenID Connect OIDC token with the 'organization' scope. This allows organization metadata to be disclosed in...

com.charlyghislain.keycloak:keycloak-importexport (>=11.0.1, <=11.0.2), fr.cnieg.keycloak:attribute-login-provider (>=1.1.0, <=1.2.4) +9 more potentially affected by CVE-2026-9704 via org.keycloak:keycloak-services (11.0.2)

org.keycloak:keycloak-services MAVEN version 11.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - com.charlyghislain.keycloak:keycloak-importexport =11.0.1, =1.1.0, =1.2.4 -...

io.github.johnjcool:keycloak-cas-services (>=4.1.0.final, <=4.1.1.final), org.keycloak:keycloak-dependencies-server-min (4.1.0.final) +3 more potentially affected by CVE-2026-9704 via org.keycloak:keycloak-services (4.1.0.final)

org.keycloak:keycloak-services MAVEN version 4.1.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - io.github.johnjcool:keycloak-cas-services =4.1.0.final, =4.1.1.final -...

de.ahus1.keycloak.dropwizard:keycloak-dropwizard (2.0.0), fr.cnieg.keycloak:attribute-login-provider (1.3.5) +59 more potentially affected by CVE-2026-9704 via org.keycloak:keycloak-server-spi-private (21.1.2)

org.keycloak:keycloak-server-spi-private MAVEN version 21.1.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-server-spi-private and may be impacted: - de.ahus1.keycloak.dropwizard:keycloak-dropwizard 2.0.0 -...

org.keycloak:keycloak-authz-policy-common (10.0.0), org.keycloak:keycloak-dependencies-server-all (10.0.0) +12 more potentially affected by CVE-2026-9704 via org.keycloak:keycloak-server-spi-private (10.0.0)

org.keycloak:keycloak-server-spi-private MAVEN version 10.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-server-spi-private and may be impacted: - org.keycloak:keycloak-authz-policy-common 10.0.0 -...

org.keycloak:keycloak-account-freemarker (1.8.0.cr2), org.keycloak:keycloak-broker-oidc (1.8.0.cr2) +9 more potentially affected by CVE-2026-9704 via org.keycloak:keycloak-services (1.8.0.cr2)

org.keycloak:keycloak-services MAVEN version 1.8.0.cr2 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.keycloak:keycloak-account-freemarker 1.8.0.cr2 - org.keycloak:keycloak-broker-oidc 1.8.0.cr...

de.arbeitsagentur.opdt:keycloak-cassandra-extension (>=0.8.3-20.0.5, <=0.10.0-20.0.5), de.arbeitsagentur.opdt:keycloak-cassandra-model-tests (>=0.8.3-20.0.5, <=0.10.0-20.0.5) +14 more potentially affected by CVE-2026-9704 via org.keycloak:keycloak-services (20.0.5)

org.keycloak:keycloak-services MAVEN version 20.0.5 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - de.arbeitsagentur.opdt:keycloak-cassandra-extension =0.8.3-20.0.5, =0.8.3-20.0.5, =0.10.0-20.0.5 -...

org.keycloak:keycloak-authz-policy-drools (2.4.0.cr1), org.keycloak:keycloak-dependencies-server-all (2.4.0.cr1) +5 more potentially affected by CVE-2026-9704 via org.keycloak:keycloak-services (2.4.0.cr1)

org.keycloak:keycloak-services MAVEN version 2.4.0.cr1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.keycloak:keycloak-authz-policy-drools 2.4.0.cr1 -...

GHSA-RR5Q-3XWR-F323 Keycloak Vulnerable to Improper Validation of Specified Quantity in Input

A flaw was found in Keycloak. An authenticated user with low privileges can exploit this vulnerability by sending an oversized subjecttoken JSON Web Token JWT to the TokenEndpoint. When the token exceeds a 4000-character limit, it is silently dropped, causing the system to fall back to client...

com.github.vzakharchenko:cisco-radius-plugin (1.2.5), com.github.vzakharchenko:keycloak-plugins (1.2.5) +15 more potentially affected by CVE-2026-9704 via org.keycloak:keycloak-services (10.0.2)

org.keycloak:keycloak-services MAVEN version 10.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - com.github.vzakharchenko:cisco-radius-plugin 1.2.5 - com.github.vzakharchenko:keycloak-plugins 1.2...

org.keycloak:keycloak-authz-policy-drools (2.5.4.final), org.keycloak:keycloak-dependencies-server-all (2.5.4.final) +5 more potentially affected by CVE-2026-9704 via org.keycloak:keycloak-services (2.5.4.final)

org.keycloak:keycloak-services MAVEN version 2.5.4.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.keycloak:keycloak-authz-policy-drools 2.5.4.final -...