User-Managed Access Bypass in Keycloak by Red Hat
CVE-2026-4636
8.1HIGH
Key Information:
- Vendor
Red Hat
- Status
- Vendor
- CVE Published:
- 2 April 2026
What is CVE-2026-4636?
A security flaw in Keycloak allows authenticated users with the uma_protection role to circumvent User-Managed Access (UMA) policy validation. This vulnerability permits attackers to include resource identifiers belonging to other users in their policy creation requests, potentially leading to unauthorized access to sensitive resources. As a result, attackers can obtain a Requesting Party Token (RPT) and perform unauthorized actions on victim-owned resources.
Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.
Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.
Affected Version(s)
Red Hat build of Keycloak 26.2 26.2.15-1
Red Hat build of Keycloak 26.2 26.2-18
Red Hat build of Keycloak 26.2 26.2-18