~ / search / GHSA-h4wv-g838-66g3

GHSA-h4wv-g838-66g3

Keycloak: Application-Level DoS via Scope Processing

Source: GitHub Advisory Database (reviewed) High CVE-2026-4634

Packages

EcosystemPackageAffectedFixed in
Maven org.keycloak:keycloak-services < 26.5.7 26.5.7

Details

As written in the advisory (Markdown source, shown as plain text).

A flaw was found in Keycloak. An unauthenticated attacker can exploit this vulnerability by sending a specially crafted POST request with an excessively long scope parameter to the OpenID Connect (OIDC) token endpoint. This leads to high resource consumption and prolonged processing times, ultimately resulting in a Denial of Service (DoS) for the Keycloak server.

References

External links from the advisory. They lead to third-party sites.