CVE-2026-4634 in Keycloak

Resumen (Inglés)

A flaw was found in Keycloak. An unauthenticated attacker can exploit this vulnerability by sending a specially crafted POST request with an excessively long scope parameter to the OpenID Connect (OIDC) token endpoint. This leads to high resource consumption and prolonged processing times, ultimately resulting in a Denial of Service (DoS) for the Keycloak server.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Responsable

redhat

Reservar

2026-03-23

Divulgación

2026-04-02

Estado

Confirmado

Voces

VulDB provides additional information and datapoints for this CVE:

ID	Vulnerabilidad	CWE	Exp	Con	CVE
354866	Keycloak denegación de servicio	1050	No está definido	No está definido	CVE-2026-4634

Fuentes

• MITRE
• NVD
• CVE Details