CVE-2026-4282: Keycloak: Privilege escalation via forged authorization codes due to SingleUseObjectProvider isolation flaw
(updated )
A flaw was found in Keycloak. The SingleUseObjectProvider, a global key-value store, lacks proper type and namespace isolation. This vulnerability allows an unauthenticated attacker to forge authorization codes. Successful exploitation can lead to the creation of admin-capable access tokens, resulting in privilege escalation.
References
- access.redhat.com/errata/RHSA-2026:6475
- access.redhat.com/errata/RHSA-2026:6476
- access.redhat.com/errata/RHSA-2026:6477
- access.redhat.com/errata/RHSA-2026:6478
- access.redhat.com/security/cve/CVE-2026-4282
- bugzilla.redhat.com/show_bug.cgi?id=2448061
- github.com/advisories/GHSA-hj93-h7pg-fh6v
- github.com/keycloak/keycloak
- github.com/keycloak/keycloak/commit/9046f201125a6fd6be9c116b99d348509d99d4a5
- github.com/keycloak/keycloak/issues/47719
- nvd.nist.gov/vuln/detail/CVE-2026-4282
Code Behaviors & Features
Detect and mitigate CVE-2026-4282 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →