ZeroDay Findings
Sign inSign up

Findings

CVE-2026-4636

A flaw was found in Keycloak.

Published Apr 2, 2026 · updated Jul 15, 2026 · redhat build of keycloak

A flaw was found in Keycloak. An authenticated user with the uma_protection role can bypass User-Managed Access (UMA) policy validation. This allows the attacker to include resource identifiers owned by other users in a policy creation request, even if the URL path specifies an attacker-owned resource. Consequently, the attacker gains unauthorized permissions to victim-owned resources, enabling them to obtain a Requesting Party Token (RPT) and access sensitive information or perform unauthorized actions.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

  1. Apr 2, 2026 · NIST NVD

    Detected

    A flaw was found in Keycloak. An authenticated user with the uma_protection role can bypass User-Managed Access (UMA) policy validation. This allows the attacker to include resource identifiers owned by other users in a policy creation request, even if the URL path specifies an attacker-owned resource. Consequently, the attacker gains unauthorized permissions to victim-owned resources, enabling th

  2. Jul 15, 2026 · NIST NVD

    Updated

    A flaw was found in Keycloak. An authenticated user with the uma_protection role can bypass User-Managed Access (UMA) policy validation. This allows the attacker to include resource identifiers owned by other users in a policy creation request, even if the URL path specifies an attacker-owned resource. Consequently, the attacker gains unauthorized permissions to victim-owned resources, enabling th

Affected

  • cpe redhat/build of keycloakversion unspecified
  • cpe redhat/build of keycloak26.2
  • cpe redhat/build of keycloak26.2.15
  • cpe redhat/build of keycloak26.4
  • cpe redhat/build of keycloak26.4.11

Sources

  • CVE.orgVulnerability recordCVE-2026-4636

    Official CVE identifier

    cve.org
  • NIST NVDVulnerability recordCVE-2026-4636

    A flaw was found in Keycloak. An authenticated user with the uma_protection role can bypass User-Managed Access (UMA) policy validation. This allows the attacker to include resource identifiers owned by other users in a policy creation request, even if the URL path specifies an a

    nvd.nist.gov

References