Vulnerability · Published May 28, 2026 · Assigned by redhat
CVE-2026-9792Keycloak: keycloak: security restriction bypass allows unauthorized ropc token acquisition
Medium 6.5
In plain English
A medium-severity security flaw in Red Hat build of Keycloak 26.4 from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 19% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
A flaw was found in Keycloak's Client Policies, specifically within the `org.keycloak.protocol.oidc` component. When certain condition providers (client-type, client-roles, client-attributes, client-scopes) are used to enforce security restrictions, the `reject-ropc-grant` executor is silently bypassed. This allows an unauthenticated remote attacker to obtain tokens via a Resource Owner Password Credentials (ROPC) grant, even when a policy is explicitly configured to block it. This bypass can lead to unauthorized access and information disclosure.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | org.keycloak:keycloak-services | 26.6.3 | GHSA-33j3-g875-37rp |
| Maven | org.keycloak:keycloak-services | no fix listed | GHSA-33j3-g875-37rp |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | Red Hat build of Keycloak 26.4 | see references |
| Red Hat | Red Hat build of Keycloak 26.4 | see references |
| Red Hat | Red Hat build of Keycloak 26.4 | see references |
| Red Hat | Red Hat build of Keycloak 26.4.13 | see references |
| Red Hat | Red Hat build of Keycloak 26.6 | see references |
| Red Hat | Red Hat build of Keycloak 26.6 | see references |
| Red Hat | Red Hat build of Keycloak 26.6 | see references |
| Red Hat | Red Hat build of Keycloak 26.6.3 | see references |
Weakness: CWE-280 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
References
- RHSA-2026:25097 vendor-advisory, x_refsource_REDHAT
- RHSA-2026:25098 vendor-advisory, x_refsource_REDHAT
- RHSA-2026:30049 vendor-advisory, x_refsource_REDHAT
- RHSA-2026:30050 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/security/cve/CVE-2026-9792 vdb-entry, x_refsource_REDHAT
- RHBZ#2482459 issue-tracking, x_refsource_REDHAT