Keycloak Vulnerabilities: Info Disclosure and Privilege Escalation

CERT-Bund has released Security Advisory WID-SEC-2026-0787 detailing critical vulnerabilities in Keycloak, specifically affecting versions prior to 26.5.6. The advisory highlights that these flaws can be exploited remotely to disclose sensitive information and escalate user privileges. The base CVSS score is 9.1, indicating a critical severity.

Organizations utilizing Keycloak, particularly those running Linux operating systems, should immediately assess their versions and apply available mitigations or update to a patched version (26.5.6 or later) to prevent unauthorized access and data breaches. Failure to address these vulnerabilities could lead to significant security incidents and potential data compromise.