Vulnerability GHSA-9jrw-8xf7-xqhq
Medium Risk
MEDIUM RISK
CVSS Score: 4.9
Score Range: 4.0–6.9
Medium severity vulnerabilities (CVSS 4.0–6.9). Important issues that meaningfully reduce security confidence.
1 day ago
October 29, 2026 at 04:38 PM UTC
Keycloak vulnerable to information disclosure through arbitrary filesystem path probing
1.0-alpha-1 and 1.0-alpha-1-12062013 - 1.0-beta-1 and 1.0-beta-1-20150521 and 1.0-beta-1-20150523 - 1.5.0-Final and 1.5.0.Final - 26.6.3
1.0-alpha-1 and 1.0-alpha-1-12062013 - 1.0-beta-1 and 1.0-beta-1-20150521 and 1.0-beta-1-20150523 - 1.5.0-Final and 1.5.0.Final - 26.6.3
Summary
Keycloak vulnerable to information disclosure through arbitrary filesystem path probing
Details
Description
A flaw was found in Keycloak. A realm administrator with the "manage-realm" role can exploit this vulnerability by submitting an arbitrary filesystem path as a keystore parameter when creating a key provider component. This allows the administrator to probe arbitrary filesystem paths, determining which files exist and are readable by the Keycloak process. This information disclosure could be used to identify high-value targets for follow-on attacks.
Related Vulnerabilities
Other vulnerabilities affecting the same packages
High Risk
1 day ago
Keycloak vulnerable to cross-site scripting (xss) via case-insensitive uri validation bypass
1.0-alpha-1 and 1.0-alpha-1-12062013 - 1.0-beta-1 and 1.0-beta-1-20150521 and 1.0-beta-1-20150523 - 1.5.0-Final and 1.5.0.Final - 26.6.3 GHSA-v3f7-2p4r-mwfw
1.0-alpha-1 and 1.0-alpha-1-12062013 - 1.0-beta-1 and 1.0-beta-1-20150521 and 1.0-beta-1-20150523 - 1.5.0-Final and 1.5.0.Final - 26.6.3 GHSA-v3f7-2p4r-mwfw
Medium Risk
1 day ago
Keycloak allows unauthorized access to resources via uma permission ticket bypass
1.0-alpha-1 and 1.0-alpha-1-12062013 - 1.0-beta-1 and 1.0-beta-1-20150521 and 1.0-beta-1-20150523 - 1.5.0-Final and 1.5.0.Final - 26.6.3 GHSA-w3p3-7cjg-vgfw
1.0-alpha-1 and 1.0-alpha-1-12062013 - 1.0-beta-1 and 1.0-beta-1-20150521 and 1.0-beta-1-20150523 - 1.5.0-Final and 1.5.0.Final - 26.6.3 GHSA-w3p3-7cjg-vgfw
High Risk
1 day ago
Keycloak vulnerable to authorization bypass via incorrect uri comparison
1.0-alpha-1 and 1.0-alpha-1-12062013 - 1.0-beta-1 and 1.0-beta-1-20150521 and 1.0-beta-1-20150523 - 1.5.0-Final and 1.5.0.Final - 26.6.3 GHSA-f5p5-6xmx-p252
1.0-alpha-1 and 1.0-alpha-1-12062013 - 1.0-beta-1 and 1.0-beta-1-20150521 and 1.0-beta-1-20150523 - 1.5.0-Final and 1.5.0.Final - 26.6.3 GHSA-f5p5-6xmx-p252
Medium Risk
1 day ago
Keycloak: Attacker can re-enable and take over disabled clients via registration access token
1.0-alpha-1 and 1.0-alpha-1-12062013 - 1.0-beta-1 and 1.0-beta-1-20150521 and 1.0-beta-1-20150523 - 1.5.0-Final and 1.5.0.Final - 26.6.3 GHSA-r7rc-c989-86g6
1.0-alpha-1 and 1.0-alpha-1-12062013 - 1.0-beta-1 and 1.0-beta-1-20150521 and 1.0-beta-1-20150523 - 1.5.0-Final and 1.5.0.Final - 26.6.3 GHSA-r7rc-c989-86g6
Critical
2 months ago
Keycloak: Unauthenticated account takeover via reset-credentials flow bypass
26.0.0 - 26.7.1 GHSA-4gv3-mc9p-5wqc
26.0.0 - 26.7.1 GHSA-4gv3-mc9p-5wqc
Impacted packages
Timeline
Published
1 day ago
October 29, 2026 at 04:38 PM UTC
Fixed (26.6.4)
Unknown
Unknown
Last Modified
1 day ago
October 29, 2026 at 04:45 PM UTC