Log in Start free

Vulnerability · Published Apr 2, 2026 · Assigned by redhat

CVE-2026-4636Keycloak: keycloak: uma policy bypass allows authenticated users to gain unauthorized access to victim-owned resources.

High 8.1

In plain English

A high-severity security flaw in Red Hat build of Keycloak 26.2 from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 38% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.1High
Exploit odds (30 days)0.4%top 62.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A flaw was found in Keycloak. An authenticated user with the uma_protection role can bypass User-Managed Access (UMA) policy validation. This allows the attacker to include resource identifiers owned by other users in a policy creation request, even if the URL path specifies an attacker-owned resource. Consequently, the attacker gains unauthorized permissions to victim-owned resources, enabling them to obtain a Requesting Party Token (RPT) and access sensitive information or perform unauthorized actions.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Mavenorg.keycloak:keycloak-services26.5.7GHSA-f2hx-5fx3-hmcv

Affected products (as reported)

VendorProductVersions
Red Hat Red Hat build of Keycloak 26.2 see references
Red Hat Red Hat build of Keycloak 26.2 see references
Red Hat Red Hat build of Keycloak 26.2 see references
Red Hat Red Hat build of Keycloak 26.2.15 see references
Red Hat Red Hat build of Keycloak 26.4 see references
Red Hat Red Hat build of Keycloak 26.4 see references
Red Hat Red Hat build of Keycloak 26.4 see references
Red Hat Red Hat build of Keycloak 26.4.11 see references

Weakness: CWE-551 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

References