PT-2026-55152 · Maven · Org.Keycloak:Keycloak-Services

Publicado 2026-05-28 · Atualizado 2026-05-28

OSV

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

A flaw was found in Keycloak. An authenticated administrator with the manage-clients role can exploit a Time-of-check to time-of-use (TOCTOU) vulnerability in the name-based admin role checks. This allows the attacker to escalate their privileges to realm-admin for all users within the realm, granting them extensive control over the system. The composite role relationship persists even after the attacker's own permissions are revoked and across system reboots.

Correção

Time Of Check To Time Of Use

Enumeração de Fraquezas

CWE-367

Identificadores relacionados

GHSA-PQ65-77RC-7R8C

Produtos afetados

Org.Keycloak:Keycloak-Services

Referências · 8

• https://github.com/keycloak/keycloak/issues/49427 · Nota
• https://github.com/keycloak/keycloak/commit/39cb8de54c8517efeda4baa8bc314fd40e9c6934 · Nota
• https://github.com/keycloak/keycloak/pull/49624 · Nota
• https://github.com/keycloak/keycloak · Nota
• https://bugzilla.redhat.com/show_bug.cgi?id=2482464 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-9796 · Nota de Segurança
• https://access.redhat.com/security/cve/CVE-2026-9796 · Nota
• https://osv.dev/vulnerability/GHSA-pq65-77rc-7r8c · Aviso do Fabricante