Technical impact
The vulnerability is caused by the SingleUseObjectProvider in Keycloak lacking proper type and namespace isolation. An attacker able to delete arbitrary single‑use entries in the global key‑value store can replay consumed action tokens, such as password reset links, thereby bypassing the intended single‑use restriction. This flaw, an example of Improper restriction of capabilities (CWE‑653), can grant unauthorized access or compromise user accounts.
Affected Systems
Affects the Red Hat build of Keycloak versions 26.2, 26.2.15, 26.4, and 26.4.11 running on RHEL 9. The severity is moderate with a CVSS score of 5.3, and the vulnerability is not listed in the CISA KEV catalog. No publicly available exploit tools or code have been reported, and the EPSS score is not provided.
Risk and Exploitability
Exploitation requires the attacker to access the mechanism that deletes single-use entries, which may occur through privileged API calls or compromise of the underlying datastore. Because the flaw involves deletion rather than direct code execution, the attack vector is likely via internal or compromised accounts rather than remote unauthenticated access. The lack of a dedicated workaround indicates the most effective mitigation is to apply the released Red Hat security updates. Until a patch is in place, the risk remains moderate; monitoring for replayed tokens and restricting network access to Keycloak can reduce the likelihood of exploitation.
Github GHSA