CVE-2026-4630

Katalog CVE

CVSS 6.8 · Medium EPSS 0,38%

Kerentanan Authorization Bypass Through User-Controlled Key pada redhat build of keycloak. Skor CVSS 3.1 6.8 (Medium) menurut redhat.com.

Deskripsi (NVD)

A flaw was found in Keycloak. An authenticated client could exploit an Insecure Direct Object Reference (IDOR) vulnerability in the Authorization Services Protection API endpoint. By knowing or obtaining a resource's unique identifier (UUID) belonging to another Resource Server within the same realm, the client could bypass authorization checks. This allows the client to perform unauthorized GET, PUT, and DELETE operations on resources, leading to information disclosure and potential unauthorized modification or deletion of data.

Rincian

Terbit di NVD

19 Mei 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

6.8 (Medium), sumber redhat.com
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-639: Authorization Bypass Through User-Controlled Key

EPSS (30 hari)

0,38% peluang dieksploitasi; lebih tinggi dari 29,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://access.redhat.com/errata/RHSA-2026:19596 advisory vendor
• https://access.redhat.com/errata/RHSA-2026:19597 advisory vendor
• https://access.redhat.com/security/cve/CVE-2026-4630 advisory vendor
• https://bugzilla.redhat.com/show_bug.cgi?id=2450245 advisory vendor