Skip to content
Multiple Vulnerabilities Disclosed in Keycloak 26.8.1 Release

Multiple Vulnerabilities Disclosed in Keycloak 26.8.1 Release

First seen 13 Oct 2026, 15:31 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 13, 2026 at 16:35 UTC
  • •Keycloak 26.8.1 fixes multiple vulnerabilities, including critical issues affecting identity management.
  • •CVE-2026-15943 allows bypassing secret masking, enabling potential secret theft.
  • •CVE-2026-18569 permits attackers to exploit unsigned logout tokens, risking user sessions.

Keycloak's latest release, version 26.8.1, addresses several vulnerabilities, including CVE-2026-15943, which allows a bypass of secret masking for OIDC identity-provider client secrets. This flaw can be exploited by a delegated IdP manager to link a malicious endpoint to a real secret. Another issue, CVE-2026-18569, permits attackers to send unsigned logout tokens, potentially forcing users to log out. The release also includes fixes for CVE-2026-82968, where account linking can be intercepted, and CVE-2026-94000, which allows privilege escalation for delegated admins. Keycloak has urged users to update to the latest version to mitigate these risks. The vulnerabilities affect various components of Keycloak's identity management services and could lead to unauthorized access and account takeovers.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-05-19
CVE-2026-37978 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-06-30
CVE-2026-4629 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-07-17
CVE-2026-15943 published
A vulnerability in Keycloak's admin API allows bypassing secret masking for OIDC identity-provider client secrets.
github.com
2026-07-17
CVE-2026-16104 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-08-04
CVE-2026-18569 published
A flaw in the OIDC backchannel logout endpoint allows attackers to send unsigned logout tokens.
github.com
2026-09-02
CVE-2026-82968 published
A flaw in the account linking process allows attackers to link their account to a victim's profile.
github.com
2026-09-19
CVE-2026-94000 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-09-19
CVE-2026-94001 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-09-23
CVE-2026-91777 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-09-28
CVE-2026-101333 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE

More articles in this cluster (4)

Following this threat?

Track CVE-2026-101333 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (22)

1 / 2

Common questions

What versions of Keycloak are affected?
Keycloak versions prior to 26.8.1 are affected by the disclosed vulnerabilities.
How urgent is the patch?
The patch is urgent as it addresses multiple critical vulnerabilities that could lead to unauthorized access.
What should I do to protect my Keycloak instance?
Update to Keycloak version 26.8.1 immediately to mitigate the identified vulnerabilities.