CVE-2026-4630

A flaw was found in Keycloak. An authenticated client could exploit an Insecure Direct Object Reference (IDOR) vulnerability in the Authorization Services Protection API endpoint. By knowing or obtaining a resource's unique identifier (UUID) belonging to another Resource Server within the same realm, the client could bypass authorization checks. This allows the client to perform unauthorized GET, PUT, and DELETE operations on resources, leading to information disclosure and potential unauthorized modification or deletion of data.

CVSS v3 6.8 MEDIUM

6.8^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.6 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://access.redhat.com/errata/RHSA-2026:19596	Vendor Advisory
https://access.redhat.com/errata/RHSA-2026:19597	Vendor Advisory
https://access.redhat.com/security/cve/CVE-2026-4630	Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2450245	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:redhat:build_of_keycloak:*:*:*:*:*:*:*:*

History

26 Oct 2026, 13:10

Type	Values Removed	Values Added
Summary		(es) Se encontró una falla en Keycloak. Un cliente autenticado podría explotar una vulnerabilidad de Referencia Directa a Objeto Insegura (IDOR) en el endpoint de la API de Protección de Servicios de Autorización. Al conocer u obtener el identificador único (UUID) de un recurso perteneciente a otro servidor de recursos dentro del mismo reino, el cliente podría eludir las comprobaciones de autorización. Esto permite al cliente realizar operaciones GET, PUT y DELETE no autorizadas en los recursos, lo que lleva a la revelación de información y a la posible modificación o eliminación no autorizada de datos.

Information

Published : 2026-05-19 12:16

Updated : 2026-10-26 20:10

NVD link : CVE-2026-4630

Mitre link : CVE-2026-4630

CVE.ORG link : CVE-2026-4630

JSON object : View

Products Affected

redhat

build_of_keycloak

CWE

CWE-639

Authorization Bypass Through User-Controlled Key

{"id": "CVE-2026-4630", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-4630", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-05-19T16:33:12.614371Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "secalert@redhat.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 1.6}]}, "affected": [{"source": "secalert@redhat.com", "affectedData": [{"cpes": ["cpe:/a:redhat:build_keycloak:26.4::el9"], "vendor": "Red Hat", "product": "Red Hat build of Keycloak 26.4", "versions": [{"status": "unaffected", "version": "26.4.12-1", "lessThan": "*", "versionType": "rpm"}], "packageName": "rhbk/keycloak-operator-bundle", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:build_keycloak:26.4::el9"], "vendor": "Red Hat", "product": "Red Hat build of Keycloak 26.4", "versions": [{"status": "unaffected", "version": "26.4-17", "lessThan": "*", "versionType": "rpm"}], "packageName": "rhbk/keycloak-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:build_keycloak:26.4::el9"], "vendor": "Red Hat", "product": "Red Hat build of Keycloak 26.4", "versions": [{"status": "unaffected", "version": "26.4-17", "lessThan": "*", "versionType": "rpm"}], "packageName": "rhbk/keycloak-rhel9-operator", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:build_keycloak:26.4::el9"], "vendor": "Red Hat", "product": "Red Hat build of Keycloak 26.4.12", "packageName": "rhbk/keycloak-rhel9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}]}], "published": "2026-05-19T12:16:19.290", "references": [{"url": "https://access.redhat.com/errata/RHSA-2026:19596", "tags": ["Vendor Advisory"], "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2026:19597", "tags": ["Vendor Advisory"], "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/security/cve/CVE-2026-4630", "tags": ["Vendor Advisory"], "source": "secalert@redhat.com"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2450245", "tags": ["Vendor Advisory"], "source": "secalert@redhat.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "secalert@redhat.com", "description": [{"lang": "en", "value": "CWE-639"}]}], "descriptions": [{"lang": "en", "value": "A flaw was found in Keycloak. An authenticated client could exploit an Insecure Direct Object Reference (IDOR) vulnerability in the Authorization Services Protection API endpoint. By knowing or obtaining a resource's unique identifier (UUID) belonging to another Resource Server within the same realm, the client could bypass authorization checks. This allows the client to perform unauthorized GET, PUT, and DELETE operations on resources, leading to information disclosure and potential unauthorized modification or deletion of data."}, {"lang": "es", "value": "Se encontr\u00f3 una falla en Keycloak. Un cliente autenticado podr\u00eda explotar una vulnerabilidad de Referencia Directa a Objeto Insegura (IDOR) en el endpoint de la API de Protecci\u00f3n de Servicios de Autorizaci\u00f3n. Al conocer u obtener el identificador \u00fanico (UUID) de un recurso perteneciente a otro servidor de recursos dentro del mismo reino, el cliente podr\u00eda eludir las comprobaciones de autorizaci\u00f3n. Esto permite al cliente realizar operaciones GET, PUT y DELETE no autorizadas en los recursos, lo que lleva a la revelaci\u00f3n de informaci\u00f3n y a la posible modificaci\u00f3n o eliminaci\u00f3n no autorizada de datos."}], "lastModified": "2026-10-26T20:10:00.160", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:redhat:build_of_keycloak:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E71FD53F-2C05-4B84-9BEE-BB287017B322", "versionEndExcluding": "26.4.12", "versionStartIncluding": "26.4"}], "operator": "OR"}]}], "sourceIdentifier": "secalert@redhat.com"}