GitHub Advisoryadvisory · Maven

GHSA-33j3-g875-37rp Keycloak Vulnerable to Improper Handling of Insufficient Permissions or Privilege

MEDIUM Published 2026-05-28 Modified 2026-07-01 Official page ↗
Aliases
CVE-2026-9792
Ecosystem
Maven
Packages
org.keycloak:keycloak-services
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Weaknesses
CWE-280
Reviewed
2026-07-01

Affected packages

• Maven org.keycloak:keycloak-services: >= 26.5.0, < 26.6.3 → fixed in 26.6.3 • Maven org.keycloak:keycloak-services: <= 26.4.7 (no fix yet)

Description

A flaw was found in Keycloak's Client Policies, specifically within the `org.keycloak.protocol.oidc` component. When certain condition providers (client-type, client-roles, client-attributes, client-scopes) are used to enforce security restrictions, the `reject-ropc-grant` executor is silently bypassed. This allows an unauthenticated remote attacker to obtain tokens via a Resource Owner Password Credentials (ROPC) grant, even when a policy is explicitly configured to block it. This bypass can lead to unauthorized access and information disclosure.

Related

Alias · CVE (1)

  • CVE-2026-9792 A flaw was found in Keycloak's Client Policies, specifically within the `org.keycloak.protocol.oidc` component. vulnerability

Weakness · CWE (1)

  • CWE-280 Improper Handling of Insufficient Permissions or Privileges weakness

References