HIGH7.4
GHSA-hj93-h7pg-fh6v
Keycloak: Privilege escalation via forged authorization codes due to SingleUseObjectProvider isolation flaw
Quick fix
GHSA-hj93-h7pg-fh6v — org.keycloak:keycloak-services: upgrade to the fixed version with the command below.
# pom.xml: bump <version>26.5.7</version> for org.keycloak:keycloak-servicesDetails
A flaw was found in Keycloak. The SingleUseObjectProvider, a global key-value store, lacks proper type and namespace isolation. This vulnerability allows an unauthenticated attacker to forge authorization codes. Successful exploitation can lead to the creation of admin-capable access tokens, resulting in privilege escalation.
Are you affected?
Enter the version of the package you're using.
Affected packages
Maven/org.keycloak:keycloak-services
Introduced in:
0Fixed in: 26.5.7Fix
# pom.xml: bump <version>26.5.7</version> for org.keycloak:keycloak-servicesReferences
- https://nvd.nist.gov/vuln/detail/CVE-2026-4282[ADVISORY]
- https://github.com/keycloak/keycloak/issues/47719[WEB]
- https://github.com/keycloak/keycloak/commit/9046f201125a6fd6be9c116b99d348509d99d4a5[WEB]
- https://access.redhat.com/errata/RHSA-2026:6475[WEB]
- https://access.redhat.com/errata/RHSA-2026:6476[WEB]
- https://access.redhat.com/errata/RHSA-2026:6477[WEB]
- https://access.redhat.com/errata/RHSA-2026:6478[WEB]
- https://access.redhat.com/security/cve/CVE-2026-4282[WEB]
- https://bugzilla.redhat.com/show_bug.cgi?id=2448061[WEB]
- https://github.com/keycloak/keycloak[PACKAGE]