Detections
Analytics

Keycloak < 26.6.4 Multiple Vulnerabilities

high Nessus Plugin ID 324966

Synopsis

The remote host is affected by multiple vulnerabilities.

Description

The version of Keycloak installed on the remote host is prior to 26.6.4. It is, therefore, affected by multiple vulnerabilities, including the following:

 - A user with group-admin privileges can escalate to realm-admin, gaining full administrative control over the realm. (CVE-2026-9099)

 - An authentication bypass exists via JWT algorithm confusion, allowing unauthorized access.
 (CVE-2026-11800)

 - Any authenticated user can bypass all authorization policies, including role, scope, and UMA permission checks, by including the configured access-denied page path within a request URL, gaining unauthorized access to protected resources. (CVE-2026-9800)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Upgrade Keycloak to version 26.6.4 or later.

See Also

https://github.com/keycloak/keycloak/releases/tag/26.6.4

Plugin Details

Severity: High

ID: 324966

File Name: keycloak_26_6_4.nasl

Version: 1.1

Type: Local

Agent: unix

Family: Misc.

Published: 7/3/2026

Updated: 7/3/2026

Configuration: Enable thorough checks (optional)

Supported Sensors: Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 4.8

Percentile: 57.71

CVSS v2

Risk Factor: High

Base Score: 8.5

Vector: CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:N

CVSS Score Source: CVE-2026-9800

CVSS v3

Risk Factor: High

Base Score: 8.1

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Vulnerability Information

CPE: cpe:/a:keycloak:keycloak

Required KB Items: Host/local_checks_enabled, Host/uname, installed_sw/Keycloak

Patch Publication Date: 6/26/2026

Vulnerability Publication Date: 6/26/2026

Reference Information

CVE: CVE-2026-11800, CVE-2026-9083, CVE-2026-9086, CVE-2026-9099, CVE-2026-9705, CVE-2026-9795, CVE-2026-9799, CVE-2026-9800

IAVB: 2026-B-0178