Authorization Bypass

Keycloak is vulnerable to an authorization bypass. The vulnerability is due to improper validation of the fullScopeAllowed field when it is omitted from a client registration or configuration request, which allows a delegated attacker to bypass the policy, create a client with full-scope access,...

CVE-2026-18570

A flaw was found in the full-scope-disabled client-policy executor within the keycloak-services component. This component is responsible for enforcing security policies during client registration and configuration in Red Hat Build of Keycloak. The issue occurs because the executor only validates...

CVE-2026-18570

A flaw was found in the full-scope-disabled client-policy executor within the keycloak-services component. This component is responsible for enforcing security policies during client registration and configuration in Red Hat Build of Keycloak. The issue occurs because the executor only validates...

PT-2026-67135

Name of the Vulnerable Software and Affected Versions Red Hat Build of Keycloak affected versions not specified Description A flaw exists in the full-scope-disabled client-policy executor within the keycloak-services component, which enforces security policies during client registration and...

CVE-2026-18570: Missing Authorization

A flaw was found in the full-scope-disabled client-policy executor within the keycloak-services component. This component is responsible for enforcing security policies during client registration and configuration in Red Hat Build of Keycloak. The issue occurs because the executor only validates...