Keycloak Vulnerability Allows Unauthorized Access and Privilege Escalation
CVE-2026-4282
7.4HIGH
Key Information:
- Vendor
Red Hat
- Status
- Vendor
- CVE Published:
- 2 April 2026
What is CVE-2026-4282?
A vulnerability has been identified in Keycloak involving the SingleUseObjectProvider, a global key-value store. This flaw allows an unauthenticated attacker to exploit the system by forging authorization codes. If successfully exploited, it could lead to the creation of admin-level access tokens, granting the attacker elevated privileges and the ability to perform sensitive operations within the system.
Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.
Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.
Affected Version(s)
Red Hat build of Keycloak 26.2 26.2.15-1
Red Hat build of Keycloak 26.2 26.2-18
Red Hat build of Keycloak 26.2 26.2-18