← Back

CVE-2026-4634

nvd nist
Published: Apr 2, 2026Modified: Jul 15, 2026

JSON object

Loading...
7.5
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Exploitability: 3.9 / Impact: 3.6
Source: secalert@redhat.com (Secondary)

Description

A flaw was found in Keycloak. An unauthenticated attacker can exploit this vulnerability by sending a specially crafted POST request with an excessively long scope parameter to the OpenID Connect (OIDC) token endpoint. This leads to high resource consumption and prolonged processing times, ultimately resulting in a Denial of Service (DoS) for the Keycloak server.

Affected (5)

Redhat
1 product
Build Of Keycloak
Configuration A
5 vulnerable
Vulnerable SoftwareAffected Versions
Redhat
Build Of Keycloak
All versions
Build Of Keycloak
Version 26.2.15
Build Of Keycloak
Version 26.2
Build Of Keycloak
Version 26.4.11
Build Of Keycloak
Version 26.4

Related CWEs

CWE-1050
Excessive Platform Resource Consumption within a Loop
The product has a loop body or loop condition that contains a control element that directly or indirectly consumes platform resources, e.g. messaging, sessions, locks, or file descriptors.

References (13)

Source: secalert@redhat.com
Vendor Advisory
Source: secalert@redhat.com
Vendor Advisory
Source: secalert@redhat.com
Vendor Advisory
Source: secalert@redhat.com
Vendor Advisory
Source: secalert@redhat.com
Vendor Advisory
Source: secalert@redhat.com
Issue TrackingVendor Advisory
Source: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
Vendor Advisory
Source: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
Vendor Advisory
Source: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
Vendor Advisory
Source: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
Vendor Advisory
Source: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
Vendor Advisory
Source: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
Issue TrackingVendor Advisory
Source: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c

Timeline

No history available yet.