A flaw was found in Keycloak. A low-privilege user, with knowledge of user credentials and client ID, can bypass a security control intended to disable the implicit flow in OpenID Connect (OIDC) clients. By manipulating client data during a session restart, an attacker can obtain an access token that should not be available. This vulnerability can also lead to the exposure of these access tokens in server logs, proxy logs, and HTTP Referrer headers, resulting in sensitive information disclosure.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - A flaw was found in Keycloak. A low-privilege user, with knowledge of user credentials and client ID, can
    bypass a security control intended to disable the implicit flow in OpenID Connect (OIDC) clients. By
    manipulating client data during a session restart, an attacker can obtain an access token that should not
    be available. This vulnerability can also lead to the exposure of these access tokens in server logs,
    proxy logs, and HTTP Referrer headers, resulting in sensitive information disclosure. (CVE-2026-7571)

Keycloak versions installed prior to 26.6.2 are affected by multiple vulnerabilities, including:

  - A flaw was found in Keycloak's redirect URI validation logic. An attacker can bypass     validation to redirect users to malicious sites, potentially leading to phishing attacks and     credential theft. (CVE-2026-7504)

  - A session fixation vulnerability exists in the OIDC login flow. An unauthenticated attacker     can pre-create sessions leading to account takeover if a user logs in using the attacker's     session. (CVE-2026-7507)

  - A flaw was found in Keycloak's SAML endpoint processing. A crafted XML request to the SAML     endpoint can cause a denial of service by consuming excessive server resources. (CVE-2026-7307)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
442652	SCA: security update for org.keycloak:keycloak-services (GHSA-hq3p-w4xv-x7vp)	Tenable Cloud Security	SCA Checks	Local	high
442652	SCA: security update for org.keycloak:keycloak-services (GHSA-hq3p-w4xv-x7vp)	Tenable Self-Hosted Container Security	SCA Checks	Local	high
316461	Keycloak < 26.6.2 Multiple Vulnerabilities	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-7571

high

Tenable Plugins

high

high

medium