CVE-2026-4629

Description

A flaw was found in Keycloak. A highly privileged user with `manage-clients` permission can exploit this vulnerability by injecting a hardcoded role mapper into any client. This action allows the user to bypass existing scope restrictions and inject the `realm-admin` role into generated tokens, resulting in privilege escalation and full administrative access to the realm.

Traduire en français

Produits concernés

• Red Hat build of Keycloak 26.4
• Red Hat build of Keycloak 26.4.14
• Red Hat build of Keycloak 26.6.5
• Redhat build of keycloak

Scores CVSS

Faiblesses (CWE)

• CWE-266

Références

• https://access.redhat.com/errata/RHSA-2026:50846
• https://access.redhat.com/errata/RHSA-2026:50847
• https://access.redhat.com/errata/RHSA-2026:50848
• https://access.redhat.com/security/cve/CVE-2026-4629 Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=2450244 ExploitVendor Advisory

Ailleurs

• NVD
• CVE.org
• CIRCL Vulnerability-Lookup
• CERT-FR
• GitHub Advisories