A flaw in Keycloak’s SingleUseObjectProvider, a global key‑value store, fails to enforce proper type and namespace isolation. This weakness permits an unauthenticated attacker to forge authorization codes. When these forged codes are exchanged, Keycloak issues access tokens that carry administrative privileges, effectively allowing the attacker to gain full control over the system. The issue aligns with CWE‑653, reflecting improper isolation of objects within the process.

The affected releases are Red Hat builds of Keycloak 26.2, including sub‑version 26.2.15, and 26.4, including 26.4.11. These versions run on Red Hat Enterprise Linux 9 and should be considered for remediation.

The vulnerability carries a CVSS score of 7.4, indicating high severity. No authentication is required and exploitation can be performed over the network by sending crafted requests. The EPSS score is not available and the vulnerability is not yet listed in the CISA KEV catalog; however, the potential impact remains significant, as successful exploitation results in total privilege escalation, compromising confidentiality, integrity, and availability of the protected resources.