PT-2026-55165 · Maven · Org.Keycloak:Keycloak-Services

Publicado 2026-05-27 · Atualizado 2026-05-27

OSV

CVSS v3.1

4.2

Média

Vetor base

AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N

A flaw was found in Keycloak, an open-source identity and access management solution. When a client application is configured to accept broad redirect Uniform Resource Identifiers (URIs), a remote attacker can manipulate the authentication process by crafting a special web address. If a user clicks this link, the client application might incorrectly prioritize attacker-controlled information over legitimate data. This vulnerability, known as HTTP parameter pollution, could allow an attacker to bypass security measures or gain unauthorized access to resources.

Correção

Enumeração de Fraquezas

CWE-1288

Identificadores relacionados

GHSA-WCVJ-VPVW-9RR5

Produtos afetados

Org.Keycloak:Keycloak-Services

Referências · 10

• https://github.com/keycloak/keycloak/issues/49430 · Nota
• https://github.com/keycloak/keycloak/commit/1f58a4b79a258bcf2ef86b58fbf0016cdb91291f · Nota
• https://github.com/keycloak/keycloak/commit/267a1a33d4dc1eac7622614ba9772b4e1e35726f · Nota
• https://github.com/keycloak/keycloak/pull/49959 · Nota
• https://github.com/keycloak/keycloak/commit/18832bcae5bebd5a1d66c2ec5fcd640e576fa625 · Nota
• https://github.com/keycloak/keycloak · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-9689 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-wcvj-vpvw-9rr5 · Aviso do Fabricante
• https://access.redhat.com/security/cve/CVE-2026-9689 · Nota
• https://bugzilla.redhat.com/show_bug.cgi?id=2481845 · Nota