GitHub Advisoryadvisory · Maven

GHSA-pq65-77rc-7r8c Keycloak has a Time-of-check Time-of-use (TOCTOU) Race Condition

MEDIUM Published 2026-05-28 Modified 2026-08-19 Official page ↗
Aliases
CVE-2026-9796
Ecosystem
Maven
Packages
org.keycloak:keycloak-server
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
Weaknesses
CWE-367
Reviewed
2026-07-01

Affected packages

• Maven org.keycloak:keycloak-server: < 26.6.4 → fixed in 26.6.4

Description

A flaw was found in Keycloak. An authenticated administrator with the `manage-clients` role can exploit a Time-of-check to time-of-use (TOCTOU) vulnerability in the name-based admin role checks. This allows the attacker to escalate their privileges to `realm-admin` for all users within the realm, granting them extensive control over the system. The composite role relationship persists even after the attacker's own permissions are revoked and across system reboots.

Related

Alias · CVE (1)

Weakness · CWE (1)

  • CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition weakness

References