Keycloak on Red Hat org.keycloak.protocol.oidc insufficient permissions or privileges

Summaryinfo

A vulnerability, which was classified as critical, was found in Keycloak on Red Hat. Affected by this vulnerability is an unknown functionality of the component org.keycloak.protocol.oidc. The manipulation results in insufficient permissions or privileges. This vulnerability is cataloged as CVE-2026-9792. The attack may be launched remotely. There is no exploit available.

Detailsinfo

A vulnerability, which was classified as critical, was found in Keycloak on Red Hat (affected version not known). Affected is some unknown functionality of the component org.keycloak.protocol.oidc. The manipulation with an unknown input leads to a insufficient permissions or privileges vulnerability. CWE is classifying the issue as CWE-280. The product does not handle or incorrectly handles when it has insufficient privileges to access resources or functionality as specified by their permissions. This may cause it to follow unexpected code paths that may leave the product in an invalid state. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

A flaw was found in Keycloak's Client Policies, specifically within the `org.keycloak.protocol.oidc` component. When certain condition providers (client-type, client-roles, client-attributes, client-scopes) are used to enforce security restrictions, the `reject-ropc-grant` executor is silently bypassed. This allows an unauthenticated remote attacker to obtain tokens via a Resource Owner Password Credentials (ROPC) grant, even when a policy is explicitly configured to block it. This bypass can lead to unauthorized access and information disclosure.

The advisory is shared for download at access.redhat.com. This vulnerability is traded as CVE-2026-9792 since 05/28/2026. The exploitability is told to be easy. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. There are neither technical details nor an exploit publicly available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 06/11/2026). The MITRE ATT&CK project declares the attack technique as T1222.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-32708). Once again VulDB remains the best source for vulnerability data.

Productinfo

Name

• Keycloak

License

• open-source

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion