CVE-2026-4282
EUVD-2026-1820802.04.2026, 13:16
A flaw was found in Keycloak. The SingleUseObjectProvider, a global key-value store, lacks proper type and namespace isolation. This vulnerability allows an unauthenticated attacker to forge authorization codes. Successful exploitation can lead to the creation of admin-capable access tokens, resulting in privilege escalation.Enginsight
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| redhat | build_of_keycloak | - |
| redhat | build_of_keycloak | 26.2 |
| redhat | build_of_keycloak | 26.2.15 |
| redhat | build_of_keycloak | 26.4 |
| redhat | build_of_keycloak | 26.4.11 |
𝑥
= Vulnerable software versions
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
| Vendor | Product | Version | Source |
|---|---|---|---|
| Red Hat | Red Hat build of Keycloak 26.2 | 26.2.15-1 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat build of Keycloak 26.2 | 26.2-18 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat build of Keycloak 26.2 | 26.2-18 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat build of Keycloak 26.4 | 26.4.11-1 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat build of Keycloak 26.4 | 26.4-14 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat build of Keycloak 26.4 | 26.4-14 ≤ 𝑥 < * | ADP |
Common Weakness Enumeration
References