Loading story…
German government CERT advisories reported a Keycloak vulnerability that can allow attackers to bypass security measures in deployments using the identity and access management platform. The issue was published in multiple advisories, indicating continued tracking and notification of the same security weakness affecting Keycloak environments.
Organizations using Keycloak should review the affected product versions and vendor guidance tied to the advisories, assess whether authentication or access-control protections could be circumvented, and prioritize remediation. Because Keycloak is commonly used for single sign-on and identity federation, a successful bypass could weaken protections around user authentication and protected applications.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
dCERT published advisory 2026-1309 for a Keycloak vulnerability described as allowing bypass of security measures. The reference provides no additional technical details or remediation information.
dCERT published advisory 2026-1213 concerning a Keycloak vulnerability described as allowing bypass of security measures. Based on the references alone, this appears to be a later advisory or update related to the same issue area.
dCERT published advisory 2026-0550 for a Keycloak vulnerability that could allow attackers to bypass security measures. No additional technical details or remediation information are provided in the reference content.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
dcert.de
Open sourcedcert.de
Open sourcedcert.de
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Keycloak disclosed and patched a high-severity privilege escalation flaw, **CVE-2026-9795**, in its Fine-Grained Admin Permissions v2 (`FGAPv2`) feature after researchers reported that a delegated administrator could bypass missing authorization checks in the admin REST API and add arbitrary realm roles to a client’s scope mapping. That weakness allowed limited administrators to inject elevated roles such as `realm-admin` into tokens later issued to users authenticating through the affected client, creating a path to downstream privilege escalation in deployments running Keycloak `26.2.0` and later with `FGAPv2` enabled. The issue was later listed as fixed in Keycloak release `26.6.4`, alongside several other security bugs including **CVE-2026-9099**, **CVE-2026-9083**, **CVE-2026-9086**, **CVE-2026-9705**, **CVE-2026-9799**, **CVE-2026-9800**, and **CVE-2026-11800**. Red Hat also shipped security updates for its Keycloak `26.4.11` images and operator on OpenShift, addressing a broad set of vulnerabilities across the Admin REST API, Account REST API, OIDC dynamic client registration, UMA authorization, token handling, redirect validation, and scope processing, with impacts ranging from information disclosure and SSRF to account takeover, policy bypass, and denial of service.
Jul 12, 2026
Red Hat disclosed **CVE-2026-4636**, a high-severity flaw in **Keycloak** that lets an authenticated user with the `uma_protection` role bypass **User-Managed Access (UMA)** policy validation. By submitting policy creation requests that reference resource identifiers owned by other users while the URL path points to an attacker-controlled resource, an attacker can obtain a **Requesting Party Token (RPT)** for victim-owned resources. The issue can expose sensitive information and permit unauthorized actions against protected resources; Red Hat linked the vulnerability to advisories **RHSA-2026:6477** and **RHSA-2026:6478**.
Jun 29, 2026
CERT/CC and independent researchers disclosed multiple critical vulnerabilities in the open-source identity and access management platform **Casdoor**, affecting version `2.362.0` and earlier. The most severe issue, **`CVE-2026-9090`**, stems from improper SAML certificate validation that can let an attacker forge assertions using a self-controlled certificate and log in without valid credentials. Additional flaws, including **`CVE-2026-9091`**, can allow multi-factor authentication bypass and exploitation of weak account-binding logic, while **`CVE-2026-9094`** and **`CVE-2026-9097`** create risks of cross-organization token abuse and privilege escalation. The disclosures warn that the vulnerabilities undermine core authentication and access-management controls in deployments using Casdoor for identity federation and tenant separation. Researchers said no official patch was available at disclosure because they were unable to coordinate with the Casdoor team, and advised defenders to apply manual mitigations such as restricting identity provider integrations, tightening identity governance, enforcing downstream MFA protections, and monitoring for anomalous SAML responses and token-exchange activity.
Jun 29, 2026