GitHub Advisoryadvisory · Maven

GHSA-hj93-h7pg-fh6v Keycloak: Privilege escalation via forged authorization codes due to SingleUseObjectProvider isolation flaw

HIGH Published 2026-04-02 Modified 2026-04-04 Official page ↗
Aliases
CVE-2026-4282
Ecosystem
Maven
Packages
org.keycloak:keycloak-services
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Weaknesses
CWE-653
Reviewed
2026-04-04

Affected packages

• Maven org.keycloak:keycloak-services: < 26.5.7 → fixed in 26.5.7

Description

A flaw was found in Keycloak. The SingleUseObjectProvider, a global key-value store, lacks proper type and namespace isolation. This vulnerability allows an unauthenticated attacker to forge authorization codes. Successful exploitation can lead to the creation of admin-capable access tokens, resulting in privilege escalation.

Related

Alias · CVE (1)

Weakness · CWE (1)

  • CWE-653 Improper Isolation or Compartmentalization weakness

References