A flaw was found in Keycloak. The SingleUseObjectProvider, a global key-value store, lacks proper type and namespace isolation. This vulnerability allows an unauthenticated attacker to forge authorization codes. Successful exploitation can lead to the creation of admin-capable access tokens, resulting in privilege escalation.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - A flaw was found in Keycloak. The SingleUseObjectProvider, a global key-value store, lacks proper type and
    namespace isolation. This vulnerability allows an unauthenticated attacker to forge authorization codes.
    Successful exploitation can lead to the creation of admin-capable access tokens, resulting in privilege
    escalation. (CVE-2026-4282)

Keycloak installed on the remote host is 26.2.x prior to 26.2.15, 26.4.x prior to  26.4.11, 26.5.x prior to 26.5.7 are affected by multiple vulnerabilities:

  - A privilege escalation flaw exists due to improper isolation in the SingleUseObjectProvider. An     unauthenticated, remote attacker can forge authorization codes and potentially obtain admin-capable     access tokens. (CVE-2026-4282)

  - A denial of service flaw exists in the OpenID Connect token endpoint. An unauthenticated, remote     attacker can exhaust server CPU and memory by sending an excessively long scope parameter.
    (CVE-2026-4634)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
463999	Echo: keycloak-25: security update to 25.0.6+e1org.keycloak:keycloak-services: security update to 26.5.7	Tenable Cloud Security	Echo Local Security Checks	Local	high
463999	Echo: keycloak-25: security update to 25.0.6+e1org.keycloak:keycloak-services: security update to 26.5.7	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	high
330085	Keycloak 26.2 < 26.2.15 / 26.4 < 26.4.11 / 26.5 < 26.5.7 Multiple Vulnerabilities	Nessus	Misc.	Local	high
439850	SCA: security update for org.keycloak:keycloak-services (GHSA-hj93-h7pg-fh6v)	Tenable Cloud Security	SCA Checks	Local	high
439850	SCA: security update for org.keycloak:keycloak-services (GHSA-hj93-h7pg-fh6v)	Tenable Self-Hosted Container Security	SCA Checks	Local	high

Detections

Analytics

CVE-2026-4282

high

Tenable Plugins

high

high

high

high

high