CVE-2026-94000 Keycloak-services: keycloak-services: delegated admin with manage-users can escalate to realm-admin via group membership

A flaw was found in the Admin REST API of Keycloak, an open-source identity and access management solution. The issue occurs in the group-membership endpoints where the system fails to check if a group grants administrative privileges before allowing a user to be added. This allows a delegated...

CVE-2026-94000 Keycloak-services: keycloak-services: delegated admin with manage-users can escalate to realm-admin via group membership

A flaw was found in the Admin REST API of Keycloak, an open-source identity and access management solution. The issue occurs in the group-membership endpoints where the system fails to check if a group grants administrative privileges before allowing a user to be added. This allows a delegated...

CVE-2026-94001

A flaw was found in the Admin REST API of Keycloak, an open-source identity and access management solution. The endpoint used for deleting user credentials does not correctly check for fine-grained reset-password permissions. This allows a delegated administrator, who should be restricted from...

CVE-2026-93999 Keycloak-services: keycloak-services: token refresh continues issuing tokens for disabled audience clients

A flaw was found in the OIDC protocol implementation of Keycloak, an open-source identity and access management solution. The issue occurs during the token refresh process when the server restores requested audiences from stored client IDs. Keycloak fails to verify if the target audience client i...

CVE-2026-93999 Keycloak-services: keycloak-services: token refresh continues issuing tokens for disabled audience clients

A flaw was found in the OIDC protocol implementation of Keycloak, an open-source identity and access management solution. The issue occurs during the token refresh process when the server restores requested audiences from stored client IDs. Keycloak fails to verify if the target audience client i...

EUVD-2026-83600

A flaw was found in the OIDC protocol implementation of Keycloak, an open-source identity and access management solution. The issue occurs during the token refresh process when the server restores requested audiences from stored client IDs. Keycloak fails to verify if the target audience client i...

CVE-2026-93999

Keycloak's OIDC token refresh process contains a flaw where the server restores requested audiences from stored client IDs but fails to verify whether the target audience client is still enabled before issuing a new access token. This allows an application holding an existing refresh token to con...

CVE-2026-94000

A flaw was found in the Admin REST API of Keycloak, an open-source identity and access management solution. The issue occurs in the group-membership endpoints where the system fails to check if a group grants administrative privileges before allowing a user to be added. This allows a delegated...

CVE-2026-93999

A flaw was found in the OIDC protocol implementation of Keycloak, an open-source identity and access management solution. The issue occurs during the token refresh process when the server restores requested audiences from stored client IDs. Keycloak fails to verify if the target audience client i...

CLEANSTART-2026-IG03697 Keycloak provides authorization services that allow administrators to restrict access to resources based on time policies (for example, only allowing access during business hours)

Security vulnerability affects the keycloak package. Keycloak provides authorization services that allow administrators to restrict access to resources based on time policies for example, only allowing access during business hours...

CLEANSTART-2026-CJ40397 flaw was found in the full-scope-disabled client-policy executor within the keycloak-services component

Security vulnerability affects the keycloak package. A flaw was found in the full-scope-disabled client-policy executor within the keycloak-services component...

CLEANSTART-2026-MZ50851 flaw was found in the user creation component of Keycloak when Fine-Grained Admin Permissions V2 (FGAP V2) is enabled

Security vulnerability affects the keycloak package. A flaw was found in the user creation component of Keycloak when Fine-Grained Admin Permissions V2 FGAP V2 is enabled...

CLEANSTART-2026-QD34582 flaw was found in the key provider component of the keycloak-services library, which is the core engine for the Red Hat Build of Keycloak

Security vulnerability affects the keycloak package. A flaw was found in the key provider component of the keycloak-services library, which is the core engine for the Red Hat Build of Keycloak...

CLEANSTART-2026-KM02072 flaw was found in the keycloak-services component of Keycloak, which is used for managing authentication and authorization flows

Security vulnerability affects the keycloak package. A flaw was found in the keycloak-services component of Keycloak, which is used for managing authentication and authorization flows...

CLEANSTART-2026-BB61412 flaw was found in the JWT Bearer authorization grant implementation within the keycloak-services component of Red Hat Build of Keycloak

Security vulnerability affects the keycloak package. A flaw was found in the JWT Bearer authorization grant implementation within the keycloak-services component of Red Hat Build of Keycloak...

CLEANSTART-2026-ZF70449 flaw was found in the role-users endpoint of the keycloak-services library, which is the core component of the Keycloak identity and access management solution

Security vulnerability affects the keycloak package. A flaw was found in the role-users endpoint of the keycloak-services library, which is the core component of the Keycloak identity and access management solution...

CLEANSTART-2026-HP97605 flaw was found in the RoleContainerResource component of Keycloak

Security vulnerability affects the keycloak package. A flaw was found in the RoleContainerResource component of Keycloak...

CLEANSTART-2026-YL24808 flaw was found in the authentication configuration endpoint of the keycloak-services component, which is the core engine for Red Hat Build of Keycloak identity and access management

Security vulnerability affects the keycloak package. A flaw was found in the authentication configuration endpoint of the keycloak-services component, which is the core engine for Red Hat Build of Keycloak identity and access management...

CLEANSTART-2026-HB26759 Keycloak provides a way to let users log in using Microsoft accounts while restricting access to a specific organization (tenant)

Security vulnerability affects the keycloak package. Keycloak provides a way to let users log in using Microsoft accounts while restricting access to a specific organization tenant...

CLEANSTART-2026-FD75876 Keycloak provides a way to manage identity providers and organizations through its administrative API

Security vulnerability affects the keycloak package. Keycloak provides a way to manage identity providers and organizations through its administrative API...