CVE-2026-4634
An unauthenticated attacker can exploit this vulnerability by sending a specially crafted POST request with an excessively long scope parameter to the OpenID Connect (OIDC) token endpoint.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.52%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
A flaw was found in Keycloak. An unauthenticated attacker can exploit this vulnerability by sending a specially crafted POST request with an excessively long scope parameter to the OpenID Connect (OIDC) token endpoint. This leads to high resource consumption and prolonged processing times, ultimately resulting in a Denial of Service (DoS) for the Keycloak server.
- CVSS 3.1
- 7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- EPSS
- 0.52% probability · 42th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-1050
- Affected
- redhat/build of keycloak
- Source
- secalert@redhat.com
References
- https://access.redhat.com/errata/RHSA-2026:6475Vendor Advisory
- https://access.redhat.com/errata/RHSA-2026:6476Vendor Advisory
- https://access.redhat.com/errata/RHSA-2026:6477Vendor Advisory
- https://access.redhat.com/errata/RHSA-2026:6478Vendor Advisory
- https://access.redhat.com/security/cve/CVE-2026-4634Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2450250Issue Tracking, Vendor Advisory
- https://access.redhat.com/errata/RHSA-2026:6475Vendor Advisory
- https://access.redhat.com/errata/RHSA-2026:6476Vendor Advisory
- https://access.redhat.com/errata/RHSA-2026:6477Vendor Advisory
- https://access.redhat.com/errata/RHSA-2026:6478Vendor Advisory
- https://access.redhat.com/security/cve/CVE-2026-4634Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2450250Issue Tracking, Vendor Advisory
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-4634.json
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.