Junglewise Threat Intelligence

CVE-2026-4634: Keycloak Denial of Service via OIDC scope parameter

CVE-2026-4634 · Severity: high · CVSS 7.5 · Published 2026-04-02

Technologies: Red Hat build of Keycloak, Red Hat build of Keycloak 26.4, org.keycloak:keycloak-services (Maven). Vendors: Red Hat, Maven.

Executive brief

Keycloak, a popular identity and access management solution, is vulnerable to a denial-of-service attack. An attacker can send a specially crafted request to the system's login endpoint that forces the server to consume excessive processing power. This can cause the authentication service to become slow or completely unresponsive, preventing legitimate users from logging into their applications.

Technical details

A flaw was identified in Keycloak's OpenID Connect (OIDC) implementation where the token endpoint does not properly limit or efficiently process the 'scope' parameter. An unauthenticated remote attacker can exploit this by sending a POST request containing an excessively long scope string. This triggers a loop or intensive processing task (CWE-1050) that consumes significant CPU and memory resources. The resulting resource exhaustion leads to prolonged processing times and a Denial of Service (DoS) condition for the Keycloak server. Red Hat has released patches for affected versions of the Red Hat build of Keycloak.

Affected products

  • Red Hat Red Hat build of Keycloak 26.2 Fixed in 26.2.15-1
  • Red Hat Red Hat build of Keycloak 26.4 Fixed in 26.4.11-1

Timeline

  • 2026-04-02: disclosed
  • 2026-04-02: patched: Fixed in Red Hat build of Keycloak 26.2.15 and 26.4.11

References

Related threats