PT-2026-29731 · Red Hat · Keycloak

Slvrqn · Published 2026-04-02 · Updated 2026-04-02 · CVE-2026-4634

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Keycloak (affected versions not specified)

Description A flaw exists in Keycloak where an unauthenticated attacker can cause a Denial of Service (DoS) by sending a crafted POST request to the OpenID Connect (OIDC) token endpoint. The attack involves an excessively long scope parameter. This leads to high resource consumption and prolonged processing times.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-1050

Related Identifiers

CVE-2026-4634

GHSA-H4WV-G838-66G3

Affected Products

Keycloak

References · 12

• https://access.redhat.com/errata/RHSA-2026:6476 · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=2450250 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2026:6475 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-4634 · Security Note
• https://access.redhat.com/errata/RHSA-2026:6478 · Vendor Advisory
• https://access.redhat.com/security/cve/CVE-2026-4634 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2026:6477 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-h4wv-g838-66g3 · Vendor Advisory
• https://github.com/keycloak/keycloak · Note
• https://github.com/keycloak/keycloak/commit/b455ee4f28abb6f2120aff72fd179589cc5267a0 · Note
• https://github.com/keycloak/keycloak/issues/47716 · Note
• https://twitter.com/CVEnew/status/2039744359675940960 · Twitter Post