The Keycloak server contains a flaw in the SingleUseObjectProvider component, an in‑memory key‑value store that is improperly isolated across different data types and namespaces. This weakness is an example of CWE‑653, Improper Isolation of Privileges. Because the store does not enforce separation, an attacker can forge OAuth2 authorization codes even when unauthenticated. Using such a forged code during the standard authorization code grant flow, the attacker receives an access token that carries administrative privileges, effectively giving the attacker control over the Keycloak realm and all associated applications.

This vulnerability affects the Red Hat build of Keycloak version 26.4 and the 26.4.11 release running on Enterprise Linux 9. The flaw is tied to the SingleUseObjectProvider component in these specific releases and does not exist in earlier Keycloak versions or in later builds that have applied the isolation fix.

The CVSS score of 7.4 indicates high severity; with an exploit path that requires only the ability to initiate an OAuth flow on a reachable Keycloak instance, an attacker can elevate privileges without authentication. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog, but the lack of additional mitigations means the risk remains significant until the vendor releases a patch that restores proper isolation.