User-Managed Access Bypass in Keycloak by Red Hat
CVE-2026-4636
8.1HIGH
Key Information:
- Vendor
Red Hat
- Status
- Vendor
- CVE Published:
- 2 April 2026
What is CVE-2026-4636?
A security flaw in Keycloak allows authenticated users with the uma_protection role to circumvent User-Managed Access (UMA) policy validation. This vulnerability permits attackers to include resource identifiers belonging to other users in their policy creation requests, potentially leading to unauthorized access to sensitive resources. As a result, attackers can obtain a Requesting Party Token (RPT) and perform unauthorized actions on victim-owned resources.
Affected Version(s)
Red Hat build of Keycloak 26.2 26.2.15-1
Red Hat build of Keycloak 26.2 26.2-18
Red Hat build of Keycloak 26.2 26.2-18