CVE-2026-4634

Description

A flaw was found in Keycloak. An unauthenticated attacker can exploit this vulnerability by sending a specially crafted POST request with an excessively long scope parameter to the OpenID Connect (OIDC) token endpoint. This leads to high resource consumption and prolonged processing times, ultimately resulting in a Denial of Service (DoS) for the Keycloak server.

References

• Advisories
• More

Details

Source: Mitre, NVD

Named Vulnerability: GHSA-h4wv-g838-66g3

Risk Information

CVSS v2

CVSS v3

EPSS