CVE-2026-4282

Name of the Vulnerable Software and Affected Versions Red Hat build of Keycloak version 26.2

Description A flaw exists in the SingleUseObjectProvider, which serves as a global key-value store. This component lacks proper type and namespace isolation, allowing an unauthenticated attacker to forge authorization codes. This can lead to the creation of access tokens with administrative capabilities, resulting in privilege escalation.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.