EUVD-2026-51924

A flaw was found in the full-scope-disabled client-policy executor within the keycloak-services component. This component is responsible for enforcing security policies during client registration and configuration in Red Hat Build of Keycloak. The issue occurs because the executor only validates...

CVE-2026-18570

CVE-2026-18570 affects the Red Hat Build of Keycloak (keycloak-services) where the full-scope-disabled client-policy executor only validates the fullScopeAllowed field if present. Omission of this field allows a delegated user to bypass policy, creating a client with full scope access and enablin...

Missing Authorization

Overview org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services. Affected versions of this package are vulnerable to Missing Authorization due to the full-scope-disabled client-policy executor. An attacker can create a client...