CVE-2026-4282

Keycloak: keycloak: privilege escalation via forged authorization codes due to singleuseobjectprovider isolation flaw

View on CVE.org
Published Apr 2, 2026 CVSS 3.1 · 7.4 High EPSS < 1% KEV · Not listed
Description
A flaw was found in Keycloak. The SingleUseObjectProvider, a global key-value store, lacks proper type and namespace isolation. This vulnerability allows an unauthenticated attacker to forge authorization codes. Successful exploitation can lead to the creation of admin-capable access tokens, resulting in privilege escalation.

Analysis

AI-generated

Technical impact

A flaw in Keycloak’s SingleUseObjectProvider, a global key‑value store, fails to enforce proper type and namespace isolation. This weakness permits an unauthenticated attacker to forge authorization codes. When these forged codes are exchanged, Keycloak issues access tokens that carry administrative privileges, effectively allowing the attacker to gain full control over the system. The issue aligns with CWE‑653, reflecting improper isolation of objects within the process.

Affected Systems

The affected releases are Red Hat builds of Keycloak 26.2, including sub‑version 26.2.15, and 26.4, including 26.4.11. These versions run on Red Hat Enterprise Linux 9 and should be considered for remediation.

Risk and Exploitability

The vulnerability carries a CVSS score of 7.4, indicating high severity. No authentication is required and exploitation can be performed over the network by sending crafted requests. The EPSS score is not available and the vulnerability is not yet listed in the CISA KEV catalog; however, the potential impact remains significant, as successful exploitation results in total privilege escalation, compromising confidentiality, integrity, and availability of the protected resources.

Remediation

Vendor Workaround

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.

OpenCVE Recommended Actions

  • Apply the latest Red Hat Keycloak update that resolves CVE‑2026‑4282.
  • No official workaround available; rely on patching.
  • Limit Keycloak exposure to trusted IP ranges or behind a firewall.
  • Monitor system logs for abnormal token issuance or admin activity.

Generated by OpenCVE AI on April 2, 2026 at 23:18 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
Github GHSA Github GHSA GHSA-hj93-h7pg-fh6v Keycloak: Privilege escalation via forged authorization codes due to SingleUseObjectProvider isolation flaw
History
Type Values Removed Values Added
CPEs cpe:2.3:a:redhat:build_of_keycloak:-:*:*:*:text-only:*:*:*
cpe:2.3:a:redhat:build_of_keycloak:26.2.15:*:*:*:text-only:*:*:*
cpe:2.3:a:redhat:build_of_keycloak:26.2:*:*:*:text-only:*:*:*
cpe:2.3:a:redhat:build_of_keycloak:26.4.11:*:*:*:text-only:*:*:*
cpe:2.3:a:redhat:build_of_keycloak:26.4:*:*:*:text-only:*:*:*
Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Important
Type Values Removed Values Added
First Time appeared Redhat build Of Keycloak
CPEs cpe:/a:redhat:build_keycloak:26.2::el9
Vendors & Products Redhat build Of Keycloak
References
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
CPEs cpe:/a:redhat:build_keycloak: cpe:/a:redhat:build_keycloak:26.4::el9
References
Type Values Removed Values Added
Description A flaw was found in Keycloak. The SingleUseObjectProvider, a global key-value store, lacks proper type and namespace isolation. This vulnerability allows an unauthenticated attacker to forge authorization codes. Successful exploitation can lead to the creation of admin-capable access tokens, resulting in privilege escalation.
Title Keycloak: keycloak: privilege escalation via forged authorization codes due to singleuseobjectprovider isolation flaw
First Time appeared Redhat
Redhat build Keycloak
Weaknesses CWE-653
CPEs cpe:/a:redhat:build_keycloak:
Vendors & Products Redhat
Redhat build Keycloak
References
Metrics cvssV3_1

{'score': 7.4, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N'}
Earlier changes (1)
Weaknesses
  • CWE-653

    Improper Isolation or Compartmentalization

Sources

Status
PUBLISHED
Assigner
redhat
Published
Updated
Jul 15, 2026, 12:56 AM
Reserved
Mar 16, 2026, 3:53 PM

View source JSON

Updated
Jun 30, 2026, 3:19 AM

JSON

Status
Modified
Published
Apr 2, 2026, 1:16 PM
Modified
Oct 26, 2026, 9:10 PM

View source JSON

Severity
Important
Public date
Apr 2, 2026, 12:30 PM

View source Bugzilla JSON

Updated
Apr 3, 2026, 9:18 AM

JSON