Executive brief
Keycloak is an open-source authentication and identity management service used by enterprises to secure access to applications. A flaw in its theme localization endpoints allows unauthenticated attackers to send crafted requests that consume server memory without limits, eventually crashing the service and disrupting authentication for all users.
Technical details
The vulnerability exists in the keycloak-services component's theme localization endpoints, which fail to validate or limit locale tag input from unauthenticated requests. Attackers can exploit this by sending a large number of unique locale tags that are cached indefinitely in memory without capacity constraints. The attack requires only network access to the Keycloak service and no authentication. By exhausting available memory, an attacker can cause a denial-of-service condition, making the authentication service unavailable to legitimate users. Patches are expected to implement input validation and cache size limits.
Affected products
- RedHat Keycloak
Timeline
- 2026-09-16: disclosed