CVE-2026-109081

A flaw was found in the first-broker-login flow of the keycloak-services component. It allows an attacker to register a matching username on an external identity provider, causing a collision in Keycloak and locking out the legitimate user.

Keycloak is an open-source identity and access management solution. A vulnerability was discovered where a user with the impersonation role can impersonate a realm administrator, gaining full administrative control over the realm, including the ability to manage users, clients, and roles.

A flaw was found in the theme localization endpoints of the keycloak-services component, which is the core service responsible for authentication flows and theme management in Keycloak. The issue occurs because the system accepts arbitrary locale tags from unauthenticated requests and stores them in a permanent in-memory cache without limits. An attacker can exploit this by sending a large number of unique locale tags, eventually causing the server to run out of memory and crash.

A flaw was found in the SAML Redirect Binding implementation of Keycloak where the custom DEFLATE compression and decompression helpers fail to release native zlib memory after use. An unauthenticated attacker can exploit this by sending repeated malformed SAML requests, leading to native memory exhaustion and a denial of service.

It was found that the cookie used for CSRF prevention in Keycloak was not unique to each session. An attacker could use this flaw to gain access to an authenticated user session, leading to possible information disclosure or further attacks.

A flaw was found in the Keycloak server's client management component. When a client is created or imported with authorization services enabled, the system fails to properly clear an internal session attribute used during setup. An authenticated attacker with client management permissions can bypass security controls and upload a malicious JavaScript policy that executes on the server.

A flaw was found in the SAML HTTP-Redirect binding implementation of Keycloak. The issue occurs because the server processes percent-encoded parameter names (like %53AMLResponse) while the signature verification logic only checks literal parameter names. An attacker can use this discrepancy to provide a crafted, unsigned SAML message that the server processes instead of a legitimately signed one, leading to full account takeover of federated users.

A flaw was found in Keycloak's administrative services (org.keycloak.services.resources.admin). A highly privileged attacker authenticated with the 'manage-clients' role could manipulate client JWKS, swap client authenticator types and reset secrets, or download legitimate signing keys. Successful exploitation allows obtaining a token with 'realm-admin' role assignments, leading to privilege escalation.

A flaw was found in Keycloak's token sanitization logic. When a protocol mapper emits structured claims using the JSON type, the check removing unauthorized role mappings only recognizes standard Java maps and fails to detect Jackson-based JSON objects. This allows an attacker to inject forged client roles into security tokens.

A flaw was found in the Keycloak Account REST API where session identification is handled incorrectly. A malicious client owner can manipulate their own security tokens to point to another user's active session. This allows access and modification of the victim's account information, potentially leading to full account takeover by changing the recovery email and resetting the password.