Detections
Analytics

Keycloak 26.6.x < 26.6.8 / 26.8.0 < 26.8.2 Multiple Vulnerabilities

medium Nessus Plugin ID 380314

Synopsis

The remote host is affected by multiple vulnerabilities.

Description

The version of Keycloak installed on the remote host is 26.6.x prior to 26.6.8, 26.8.x prior to 26.8.2. It is, therefore, affected by multiple vulnerabilities:

 - A flaw was found in the OIDC logout endpoint of the keycloak-services component, which handles user session termination. The issue occurs because the system sets a session cookie based on an unvalidated token hint before completing security checks. An attacker can use this flaw to fix a session ID in a victim's browser, allowing them to hijack the victim's subsequent login and gain full control over their account.
 (CVE-2026-107124)

 - A flaw was found in Keycloak. The Dynamic Client Registration (DCR) endpoint does not properly validate authorization when processing the deprecated defaultRoles field. An authenticated attacker with client creation privileges or an Initial Access Token (IAT) can inject excessive roles into the realm's default roles configuration. This causes clients across the realm to generate bloated access tokens, resulting in performance and memory degradation that can lead to a denial of service. (CVE-2026-109081)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Upgrade Keycloak to version 26.6.8 or later.

See Also

https://access.redhat.com/errata/RHSA-2026:95761

https://access.redhat.com/errata/RHSA-2026:95762

https://access.redhat.com/security/cve/CVE-2026-107124

https://access.redhat.com/security/cve/CVE-2026-109081

Plugin Details

Severity: Medium

ID: 380314

File Name: keycloak_26_6_8.nasl

Version: 1.1

Type: Local

Agent: unix

Family: Misc.

Published: 11/13/2026

Updated: 11/13/2026

Configuration: Enable thorough checks (optional)

Supported Sensors: Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 4.3

Percentile: 53.55

CVSS v2

Risk Factor: Medium

Base Score: 6.6

Vector: CVSS2#AV:N/AC:H/Au:S/C:C/I:C/A:N

CVSS Score Source: CVE-2026-107124

CVSS v3

Risk Factor: Medium

Base Score: 6.8

Vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H

CVSS Score Source: CVE-2026-109081

Vulnerability Information

CPE: cpe:/a:keycloak:keycloak

Required KB Items: Host/local_checks_enabled, Host/uname, installed_sw/Keycloak

Patch Publication Date: 11/6/2026

Vulnerability Publication Date: 11/5/2026

Reference Information

CVE: CVE-2026-107124, CVE-2026-109081

IAVB: 2026-B-0328