Detections
Analytics

Keycloak < 26.4.11 Multiple Vulnerabilities

medium Nessus Plugin ID 305939

Synopsis

The remote host is affected by multiple vulnerabilities.

Description

Keycloak versions installed prior to 26.4.11 are affected by multiple vulnerabilities:

 - A flaw was identified in the Account REST API of Keycloak that allows a user authenticated at a lower security level to perform sensitive actions intended only for higher-assurance sessions. Specifically, an attacker who has already obtained a victim's password can delete the victim's registered MFA/OTP credential without first proving possession of that factor.
 The attacker can then register their own MFA device, effectively taking full control of the account. This weakness undermines the intended protection provided by multi-factor authentication. (CVE-2026-3429)

 - A flaw was found in Keycloak. An authorization bypass vulnerability in the Keycloak Admin API allows any authenticated user, even those without administrative privileges, to enumerate the organization memberships of other users. This information disclosure occurs if the attacker knows the victim's unique identifier (UUID) and the Organizations feature is enabled. (CVE-2026-2366)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Upgrade Keycloak to 26.4.11 or later.

See Also

https://access.redhat.com/security/cve/cve-2026-2366

https://access.redhat.com/security/cve/cve-2026-3429

Plugin Details

Severity: Medium

ID: 305939

File Name: keycloak_26_4_11.nasl

Version: 1.1

Type: Local

Agent: unix

Family: Misc.

Published: 4/10/2026

Updated: 4/10/2026

Configuration: Enable thorough checks (optional)

Supported Sensors: Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 4.0

CVSS v2

Risk Factor: Low

Base Score: 3.6

Vector: CVSS2#AV:N/AC:H/Au:S/C:P/I:P/A:N

CVSS Score Source: CVE-2026-3429

CVSS v3

Risk Factor: Medium

Base Score: 4.2

Vector: CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N

Vulnerability Information

CPE: cpe:/a:keycloak:keycloak

Required KB Items: Host/local_checks_enabled, Host/uname

Patch Publication Date: 2/11/2026

Vulnerability Publication Date: 2/11/2026

Reference Information

CVE: CVE-2026-2366, CVE-2026-3429

IAVB: 2026-B-0092