CVE-2026-4634
Keycloak: keycloak: denial of service via excessive processing of openid connect scope parameters
A flaw was found in Keycloak. An unauthenticated attacker can exploit this vulnerability by sending a specially crafted POST request with an excessively long scope parameter to the OpenID Connect (OIDC) token endpoint. This leads to high resource consumption and prolonged processing times, ultimately resulting in a Denial of Service (DoS) for the Keycloak server.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Keycloak: keycloak: denial of service via excessive processing of openid connect scope parameters
A flaw was found in Keycloak. An unauthenticated attacker can exploit this vulnerability by sending a specially crafted POST request with an excessively long scope parameter to the OpenID Connect (OIDC) token endpoint. This leads to high resource consumption and prolonged processing times, ultimately resulting in a Denial of Service (DoS) for the Keycloak server.
- Record
CVE-2026-4634- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-1050, CWE-1050
- Updated
- 2026-11-02
EUVDEUVD-2026-18212
A flaw was found in Keycloak. An unauthenticated attacker can exploit this vulnerability by sending a specially crafted POST request with an excessively long scope parameter to the OpenID Connect (OIDC) token endpoint. This leads to high resource consumption and prolonged processing times, ultimately resulting in a Denial of Service (DoS) for the Keycloak server.
- Record
EUVD-2026-18212- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-h4wv-g838-66g3
Keycloak: Application-Level DoS via Scope Processing
A flaw was found in Keycloak. An unauthenticated attacker can exploit this vulnerability by sending a specially crafted POST request with an excessively long scope parameter to the OpenID Connect (OIDC) token endpoint. This leads to high resource consumption and prolonged processing times, ultimately resulting in a Denial of Service (DoS) for the Keycloak server.
- Record
GHSA-h4wv-g838-66g3- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-1050
- Updated
- 2026-11-02
NVD
A flaw was found in Keycloak. An unauthenticated attacker can exploit this vulnerability by sending a specially crafted POST request with an excessively long scope parameter to the OpenID Connect (OIDC) token endpoint. This leads to high resource consumption and prolonged processing times, ultimately resulting in a Denial of Service (DoS) for the Keycloak server.
- Record
CVE-2026-4634- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-1050
- Updated
- 2026-11-02
OSVGHSA-h4wv-g838-66g3
Keycloak: Application-Level DoS via Scope Processing
A flaw was found in Keycloak. An unauthenticated attacker can exploit this vulnerability by sending a specially crafted POST request with an excessively long scope parameter to the OpenID Connect (OIDC) token endpoint. This leads to high resource consumption and prolonged processing times, ultimately resulting in a Denial of Service (DoS) for the Keycloak server.
- Record
GHSA-h4wv-g838-66g3- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-1050
- Updated
- 2026-11-02
OSVRHSA-2026:76128
Red Hat Security Advisory: Red Hat Single Sign-On 7.6.13 security update on RHEL 7
- Record
RHSA-2026:76128- CVSS 3.1
- 9.6 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L - Updated
- 2026-11-02
OSVRHSA-2026:76129
Red Hat Security Advisory: Red Hat Single Sign-On 7.6.13 security update on RHEL 8
- Record
RHSA-2026:76129- CVSS 3.1
- 9.6 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L - Updated
- 2026-11-02
OSVRHSA-2026:76130
Red Hat Security Advisory: Red Hat Single Sign-On 7.6.13 security update on RHEL 9
- Record
RHSA-2026:76130- CVSS 3.1
- 9.6 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L - Updated
- 2026-11-02
OSVBIT-keycloak-2026-4634 No score
Keycloak: keycloak: denial of service via excessive processing of openid connect scope parameters
A flaw was found in Keycloak. An unauthenticated attacker can exploit this vulnerability by sending a specially crafted POST request with an excessively long scope parameter to the OpenID Connect (OIDC) token endpoint. This leads to high resource consumption and prolonged processing times, ultimately resulting in a Denial of Service (DoS) for the Keycloak server.
- Record
BIT-keycloak-2026-4634- Updated
- 2026-11-02
Affected products
- red hat build of keycloak 26.2
- red hat build of keycloak 26.2.15
- red hat build of keycloak 26.4
- red hat build of keycloak 26.4.11
- red hat single sign-on 7.6 for rhel 7
- red hat single sign-on 7.6 for rhel 8
- red hat single sign-on 7.6 for rhel 9
- red hat single sign-on 7.6.13
- red hat rhel-8 based middleware containers
- redhat build of keycloak
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.keycloak:keycloak-servicesMaven |
before 26.5.7 | 26.5.7 |
keycloakBitnami |
26.2.0 up to 26.2.1, 26.2.15 up to 26.3.0, 26.4.0 up to 26.4.1, 26.4.11 up to 26.5.0 | 26.2.126.3.026.4.126.5.0 |
org.keycloak:keycloak-servicesMaven |
before 26.5.7, plus listed versions 1.0-alpha-11.0-alpha-1-120620131.0-alpha-21.0-alpha-31.0-alpha-4 Show 45 moreShow less1.0-beta-11.0-beta-1-201505211.0-beta-1-201505231.0-beta-21.0-beta-31.0-beta-41.0-final1.0-rc-11.0-rc-21.0.1.Final1.0.2.Final1.0.3.Final1.0.4.Final1.0.5.Final1.1.0.Beta11.1.0.Beta21.1.0.Final1.1.1.Final1.2.0.Beta11.2.0.CR11.2.0.Final1.3.0.Final1.3.1.Final1.4.0.Final1.5.0-Final1.5.0.Final1.5.1.Final1.6.0.Final1.6.1.Final1.7.0.CR11.7.0.Final1.8.0.Alpha11.8.0.CR11.8.0.CR21.8.0.CR31.8.0.Final1.8.1.Final1.9.0.CR11.9.0.Final1.9.1.Final1.9.2.Final1.9.3.Final1.9.4.Final1.9.5.Final1.9.7.Final |
26.5.7 |
rh-sso7-keycloakRed Hat:red_hat_single_sign_on:7.6::el7 From an advisory covering 27 CVEs |
before 0:18.0.20-1.redhat_00001.1.el7sso | 0:18.0.20-1.redhat_00001.1.el7sso |
rh-sso7-keycloak-serverRed Hat:red_hat_single_sign_on:7.6::el7 From an advisory covering 27 CVEs |
before 0:18.0.20-1.redhat_00001.1.el7sso | 0:18.0.20-1.redhat_00001.1.el7sso |
rh-sso7-keycloakRed Hat:red_hat_single_sign_on:7.6::el8 From an advisory covering 27 CVEs |
before 0:18.0.20-1.redhat_00001.1.el8sso | 0:18.0.20-1.redhat_00001.1.el8sso |
rh-sso7-keycloak-serverRed Hat:red_hat_single_sign_on:7.6::el8 From an advisory covering 27 CVEs |
before 0:18.0.20-1.redhat_00001.1.el8sso | 0:18.0.20-1.redhat_00001.1.el8sso |
rh-sso7-keycloakRed Hat:red_hat_single_sign_on:7.6::el9 From an advisory covering 27 CVEs |
before 0:18.0.20-1.redhat_00001.1.el9sso | 0:18.0.20-1.redhat_00001.1.el9sso |
rh-sso7-keycloak-serverRed Hat:red_hat_single_sign_on:7.6::el9 From an advisory covering 27 CVEs |
before 0:18.0.20-1.redhat_00001.1.el9sso | 0:18.0.20-1.redhat_00001.1.el9sso |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-4634 is a high vulnerability (CVSS 7.5) in Red Hat Build Of Keycloak 26.2, published April 2, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.64%, the 50th percentile. Fixed in org.keycloak:keycloak-services 26.5.7.
References
access.redhat.com/errata/RHSA-2026:6475
Show 154 moreShow less
bugzilla.redhat.com/show_bug.cgi?id=2450250
security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-4634.json
nvd.nist.gov/vuln/detail/CVE-2026-4634
github.com/keycloak/keycloak/issues/47716
cve.org/CVERecord?id=CVE-2025-9784
issues.redhat.com/browse/UNDERTOW-2598
kb.cert.org/vuls/id/767506
Left out here: 173 versions. The JSON record has them.