CVE-2026-1035

A flaw was found in the Keycloak server during refresh token processing, specifically in the TokenManager class responsible for enforcing refresh token reuse policies. When strict refresh token rotation is enabled, the validation and update of refresh token usage are not performed atomically. Thi...

EUVD-2026-3691

A flaw was found in the Keycloak server during refresh token processing, specifically in the TokenManager class responsible for enforcing refresh token reuse policies. When strict refresh token rotation is enabled, the validation and update of refresh token usage are not performed atomically. Thi...

CVE-2026-1035 Org.keycloak.protocol.oidc: keycloak refresh token reuse bypass via toctou race condition

A flaw was found in the Keycloak server during refresh token processing, specifically in the TokenManager class responsible for enforcing refresh token reuse policies. When strict refresh token rotation is enabled, the validation and update of refresh token usage are not performed atomically. Thi...

CVE-2026-1035

CVE-2026-1035 describes a race condition in Keycloak’s TokenManager when strict refresh token rotation is enabled: the validation/update of refresh token usage is not atomic, allowing concurrent refresh requests to bypass single-use enforcement and issue multiple access tokens from one refresh to...

CVE-2026-1035

A flaw was found in the Keycloak server during refresh token processing, specifically in the TokenManager class responsible for enforcing refresh token reuse policies. When strict refresh token rotation is enabled, the validation and update of refresh token usage are not performed atomically. Thi...

PT-2026-3753

Name of the Vulnerable Software and Affected Versions Keycloak affected versions not specified Description A flaw exists in the keycloak-services component of Keycloak. This issue allows the issuance of access and refresh tokens for disabled users, potentially leading to unauthorized use of...

CVE-2025-14559: Undefined Security Weakness

A flaw was found in the keycloak-services component of Keycloak. This vulnerability allows the issuance of access and refresh tokens for disabled users, leading to unauthorized use of previously revoked privileges, via a business logic vulnerability in the Token Exchange implementation when a...

CVE-2026-1035: Time-of-check Time-of-use (TOCTOU) Race Condition

A flaw was found in the Keycloak server during refresh token processing, specifically in the TokenManager class responsible for enforcing refresh token reuse policies. When strict refresh token rotation is enabled, the validation and update of refresh token usage are not performed atomically. Thi...

PT-2026-3762

A flaw was found in the Keycloak Admin REST API. This vulnerability allows the exposure of backend schema and rules, potentially leading to targeted attacks or privilege escalation via improper access control...

Keycloak Access Control Vulnerability

Keycloak is an open-source identity and access management solution developed by Keycloak. Keycloak has a vulnerability related to access control, which can expose the backend architecture and rules. This vulnerability may lead to improper access control, potentially allowing targeted attacks or...

CVE-2025-14083: Improper Access Control

A flaw was found in the Keycloak Admin REST API. This vulnerability allows the exposure of backend schema and rules, potentially leading to targeted attacks or privilege escalation via improper access control...

Keycloak security vulnerabilities

Keycloak is an open-source identity and access management solution developed by Keycloak itself. Keycloak has a security vulnerability, which stems from the TokenManager class’s inability to perform atomic validation and updates during the processing of refresh tokens. This issue may allow...

PT-2026-3754

A flaw was found in the Keycloak server during refresh token processing, specifically in the TokenManager class responsible for enforcing refresh token reuse policies. When strict refresh token rotation is enabled, the validation and update of refresh token usage are not performed atomically. Thi...

Keycloak security vulnerabilities

Keycloak is an open-source identity and access management solution developed by Keycloak itself. Keycloak has a security vulnerability, which stems from a business logic flaw in the token exchange mechanism. This flaw may lead to the issuance of access and refresh tokens for disabled users,...

com.c4-soft.springaddons:spring-security-test-keycloack-addons (1.2.0), com.github.vzakharchenko:keycloak-plugins (1.0.2) +40 more potentially affected by CVE-2026-1180 via org.keycloak:keycloak-adapter-core (8.0.2)

org.keycloak:keycloak-adapter-core MAVEN version 8.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-adapter-core and may be impacted: - com.c4-soft.springaddons:spring-security-test-keycloack-addons 1.2.0 -...

org.keycloak:keycloak-appliance-dist-all (1.0-beta-1), org.keycloak:keycloak-as7-adapter-dist (1.0-beta-1) +8 more potentially affected by CVE-2026-1180 via org.keycloak:keycloak-adapter-core (1.0-beta-1)

org.keycloak:keycloak-adapter-core MAVEN version 1.0-beta-1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-adapter-core and may be impacted: - org.keycloak:keycloak-appliance-dist-all 1.0-beta-1 -...

com.github.vzakharchenko:chillispot-radius-plugin (1.3.3), com.github.vzakharchenko:cisco-radius-plugin (1.3.3) +61 more potentially affected by CVE-2026-1180 via org.keycloak:keycloak-adapter-core (12.0.2)

org.keycloak:keycloak-adapter-core MAVEN version 12.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-adapter-core and may be impacted: - com.github.vzakharchenko:chillispot-radius-plugin 1.3.3 -...

com.github.vzakharchenko:chillispot-radius-plugin (1.3.19), com.github.vzakharchenko:cisco-radius-plugin (1.3.19) +54 more potentially affected by CVE-2026-1180 via org.keycloak:keycloak-adapter-core (16.1.1)

org.keycloak:keycloak-adapter-core MAVEN version 16.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-adapter-core and may be impacted: - com.github.vzakharchenko:chillispot-radius-plugin 1.3.19 -...

org.keycloak:keycloak-installed (1.0-beta-1-20150523), org.keycloak:keycloak-jboss-adapter-core (1.0-beta-1-20150523) +4 more potentially affected by CVE-2026-1180 via org.keycloak:keycloak-adapter-core (1.0-beta-1-20150523)

org.keycloak:keycloak-adapter-core MAVEN version 1.0-beta-1-20150523 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-adapter-core and may be impacted: - org.keycloak:keycloak-installed 1.0-beta-1-20150523 -...

org.keycloak:keycloak-installed-adapter (1.8.0.cr2), org.keycloak:keycloak-jaxrs-oauth-client (1.8.0.cr2) +28 more potentially affected by CVE-2026-1180 via org.keycloak:keycloak-adapter-core (1.8.0.cr2)

org.keycloak:keycloak-adapter-core MAVEN version 1.8.0.cr2 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-adapter-core and may be impacted: - org.keycloak:keycloak-installed-adapter 1.8.0.cr2 -...