Skip to content
Multiple Vulnerabilities in Keycloak Expose User Accounts to Attack

Multiple Vulnerabilities in Keycloak Expose User Accounts to Attack

First seen 6 Nov 2026, 01:44 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •November 6, 2026 at 01:45 UTC
  • •Four critical vulnerabilities in Keycloak disclosed on November 5, 2026.
  • •CVE-2026-112208 allows bypassing authentication, risking account takeovers.
  • •CVE-2026-103112 exploits a race condition during credential resets for full account access.

Keycloak, an open-source identity and access management solution, has multiple vulnerabilities disclosed on November 5, 2026. CVE-2026-112208 allows attackers to bypass authentication and take over accounts by exploiting a flaw in the organization identity-first login flow. CVE-2026-103112 enables authenticated attackers to exploit a race condition during credential resets, potentially allowing full account takeover. Additionally, CVE-2026-110931 and CVE-2026-107602 present denial of service risks through infinite loops in SAML parsing, leading to service outages. These vulnerabilities affect organizations using Keycloak, particularly those with multi-organization setups or internet-accessible identity services. Immediate remediation is necessary as no dependable workarounds are available.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated 5h ago How this analysis works

Timeline

2026-11-05
Multiple CVEs published
CVE-2026-112208, CVE-2026-103112, CVE-2026-110931, and CVE-2026-107602 disclosed, affecting Keycloak.
Redpacketsecurity
2026-11-05
Red Hat assesses vulnerabilities
Red Hat classifies the vulnerabilities as Important, highlighting risks of account takeover and service denial.
access.redhat.com
2026-11-05
CVE-2026-107602 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-11-05
CVE-2026-103112 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-11-05
CVE-2026-112208 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-11-05
CVE-2026-110931 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE

More articles in this cluster (11)

Following this threat?

Track CVE-2026-103112 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (12)

1 / 4

Common questions

What are the main vulnerabilities in Keycloak?
The main vulnerabilities include CVE-2026-112208, CVE-2026-103112, CVE-2026-110931, and CVE-2026-107602, affecting authentication and service availability.
How urgent is the response to these vulnerabilities?
Immediate action is required as these vulnerabilities pose significant risks to account security and service availability.
What should organizations do to mitigate these risks?
Organizations should apply the latest patches from Red Hat and monitor for suspicious activity related to authentication flows.