~ / search / GHSA-hj93-h7pg-fh6v

GHSA-hj93-h7pg-fh6v

Keycloak: Privilege escalation via forged authorization codes due to SingleUseObjectProvider isolation flaw

Source: GitHub Advisory Database (reviewed) High CVE-2026-4282

Packages

EcosystemPackageAffectedFixed in
Maven org.keycloak:keycloak-services < 26.5.7 26.5.7

Details

As written in the advisory (Markdown source, shown as plain text).

A flaw was found in Keycloak. The SingleUseObjectProvider, a global key-value store, lacks proper type and namespace isolation. This vulnerability allows an unauthenticated attacker to forge authorization codes. Successful exploitation can lead to the creation of admin-capable access tokens, resulting in privilege escalation.

References

External links from the advisory. They lead to third-party sites.