CVE-2026-4282
A flaw was found in Keycloak.
Published Apr 2, 2026 · updated Jul 15, 2026 · redhat build of keycloak
A flaw was found in Keycloak. The SingleUseObjectProvider, a global key-value store, lacks proper type and namespace isolation. This vulnerability allows an unauthenticated attacker to forge authorization codes. Successful exploitation can lead to the creation of admin-capable access tokens, resulting in privilege escalation.
Code
The project this record applies to. Exploit listings stay in References.
No public source repository is identified for this product.
Timeline
Detection, updates, and resolution for this record.
Apr 2, 2026 · NIST NVD
Detected
A flaw was found in Keycloak. The SingleUseObjectProvider, a global key-value store, lacks proper type and namespace isolation. This vulnerability allows an unauthenticated attacker to forge authorization codes. Successful exploitation can lead to the creation of admin-capable access tokens, resulting in privilege escalation.
Jul 15, 2026 · NIST NVD
Updated
A flaw was found in Keycloak. The SingleUseObjectProvider, a global key-value store, lacks proper type and namespace isolation. This vulnerability allows an unauthenticated attacker to forge authorization codes. Successful exploitation can lead to the creation of admin-capable access tokens, resulting in privilege escalation.
Affected
- cpe redhat/build of keycloakversion unspecified
- cpe redhat/build of keycloak26.2
- cpe redhat/build of keycloak26.2.15
- cpe redhat/build of keycloak26.4
- cpe redhat/build of keycloak26.4.11
Sources
- CVE.orgVulnerability recordCVE-2026-4282
Official CVE identifier
cve.org - NIST NVDVulnerability recordCVE-2026-4282
A flaw was found in Keycloak. The SingleUseObjectProvider, a global key-value store, lacks proper type and namespace isolation. This vulnerability allows an unauthenticated attacker to forge authorization codes. Successful exploitation can lead to the creation of admin-capable ac
nvd.nist.gov