CVE-2026-117859 Keycloak-services: keycloak-services: par single-use bypass via flow restart

A flaw was found in the Pushed Authorization Request PAR implementation of the keycloak-services component. The issue occurs when an authentication flow is restarted, which incorrectly clears the internal markers used to track PAR consumption while leaving the request active. This allows an...

CVE-2026-117859

A flaw exists in the Pushed Authorization Request (PAR) implementation of the keycloak-services component. When an authentication flow is restarted, the system incorrectly clears internal markers used to track PAR consumption while keeping the request active. This allows an attacker to reuse the ...