6.8
Moyenne
CVE-2026-9802 A flaw was found in Keycloak
Description
A flaw was found in Keycloak. When revokeRefreshToken=true is enabled and persistent session storage is in use, a server restart can reset internal timing mechanisms. This allows a remote attacker, who has previously captured a user's refresh token, to replay that token even after it has been revoked. Successful exploitation grants the attacker unauthorized access to the victim's account, potentially leading to information disclosure or privilege escalation.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Red Hat Build of Keycloak | Versions non publiées | |
| Red Hat build of Keycloak 26.6.3 | Versions non publiées | |
| Red Hat build of Keycloak 26.6 26.6 | premières → < 26.6-6 | 26.6-6 |
| Red Hat build of Keycloak 26.6.4 | Versions non publiées | |
| Red Hat build of Keycloak 26.4 26.4 | premières → < 26.4-19 | 26.4-19 |
| Red Hat build of Keycloak 26.4.13 | Versions non publiées |
Autres CVE de Red Hat Build of Keycloak
Les 277 CVE de Red Hat Build of Keycloak →
CVE-2026-120984
Keycloak-services: keycloak-services: manage-clients to arbitrary code execution through inline javascript policy import
9.1
Critique
CVE-2026-9797
Keycloak: keycloak: privilege escalation via client authentication manipulation by an authenticated administrator
6.5
Moyenne
CVE-2026-97848
Keycloak-services: keycloak-services: protocol mapper with jsontype=json bypasses token sanitization
6.5
Moyenne
CVE-2026-97367
Keycloak-services: keycloak-services: dcr azp and sid claim substitution allows account rest session takeover
6.4
Moyenne