Keycloak Vulnerabilities Allow Remote Authenticated Attacks

CERT-Bund has issued a security advisory (WID-SEC-2026-0821) concerning multiple vulnerabilities in Keycloak, an open-source identity and access management solution. These vulnerabilities, rated with a CVSS base score of 5.8, allow remote authenticated attackers to bypass security controls and potentially disclose sensitive information. The advisory applies to Keycloak versions running on Linux and UNIX operating systems.

Organizations utilizing Keycloak for single sign-on should immediately assess their systems for the described vulnerabilities. While no specific mitigation is provided in this advisory, prompt patching or implementing compensating controls is recommended to prevent unauthorized access and information disclosure. The advisory notes a CVSS temporal score of 5.3, indicating the vulnerability's current exploitability.