Auth bypass in Red Hat Build Of Keycloak
CVE-2026-94217
A flaw was found in the User-Managed Access (UMA) implementation of Keycloak. The issue occurs in the authorization token endpoint when processing permission tickets. If two different users own resources with the same name, the system incorrectly merges the permissions from both resources when one user requests an authorization token. This allows an attacker to gain access scopes on a victim's resource that were never intended to be shared.
Vulnerability class: Broken Access Control
CVSS v3 metric
CVSS v3 base score 3.5 (Low). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N.
Affected products
Weakness classification (CWE)
References
- secalert@redhat.com (x_refsource_REDHAT, vdb-entry)
- secalert@redhat.com (x_refsource_REDHAT, issue-tracking)
Frequently asked questions
- What is CVE-2026-94217?
- CVE-2026-94217 is a low-severity vulnerability in Red Hat Build Of Keycloak, classified under Missing Authorization. CVSS score: 3.5/10. Published 2026-09-21.
- How severe is CVE-2026-94217?
- Low severity. CVSS v3 base score is 3.5 out of 10.