IDPTrust
IDPTrust Blog
blog.idptrust.com
Keycloak 26.6.3 Release Notes — 16 CVEs Patched, Including Privilege Escalation and SSRF

Keycloak 26.6.3 Release Notes — 16 CVEs Patched, Including Privilege Escalation and SSRF

· Security · IDPTrust

Keycloak 26.6.3 was released on June 4, 2026. Like its predecessor 26.6.2, this is almost entirely a security release: 16 CVEs fixed in a single drop. The list includes privilege escalation via token exchange, server-side request forgery on the OIDC endpoint, and refresh tokens surviving a server restart. If your Keycloak instance is reachable over the network, this update is not optional.

Here are the points that matter most.

The most urgent ones

CVE-2026-9704 — Privilege escalation via silent deletion of subject_token

During token exchange, Keycloak silently drops the subject_token parameter under certain conditions instead of rejecting the request. An attacker can abuse this to obtain tokens with elevated privileges without presenting valid credentials for the target identity.

CVE-2026-4874 — Server-Side Request Forgery via OIDC token endpoint

A crafted request to the OIDC token endpoint can cause Keycloak to perform outbound HTTP requests to attacker-controlled destinations. Exploitable remotely. Relevant for any deployment where Keycloak can reach internal services.

CVE-2026-8922 — Token introspection ignoring realm-level notBefore

The OIDC introspection endpoint does not enforce the realm-level notBefore policy. Tokens that should have been invalidated by a realm-wide credential reset remain valid from the introspection endpoint's perspective.

CVE-2026-9802 — Rotated refresh tokens reusable after server restart

Refresh token rotation state is not persisted across server restarts. After a restart, previously rotated (and therefore invalidated) refresh tokens become usable again. Affects any deployment using refresh token rotation.

Access control and data leakage

  • CVE-2026-37977 — Access-Control-Allow-Origin reflected in the UMA endpoint based on an unverified JWT claim. Enables cross-origin requests from attacker-controlled origins.
  • CVE-2026-7500 — Improper access control when the Account API is disabled at realm level. Certain endpoints remain accessible despite the feature being off.
  • CVE-2026-9088 — Group members endpoint bypasses user profile permission checks. Callers can enumerate group members even when profile visibility is restricted.
  • CVE-2026-9791 — Organization-scoped data exposed through APIs when the Organizations feature is disabled.
  • CVE-2026-9792 — ROPC (Resource Owner Password Credentials) grant bypasses client policy enforcement. Policies intended to restrict direct grant usage can be circumvented.

Identity federation and WebAuthn

  • CVE-2026-8830 — Missing validations during WebAuthn credential registration allow enrolling credentials that bypass attestation checks.
  • CVE-2026-9087 — Email verification in first-broker-login is not bound to the upstream identity. A user can verify an email that belongs to a different identity provider account.

Denial of service

  • CVE-2026-0707 — Malformed Authorization header in ClientRegistrationAuth triggers an unhandled exception and causes a DoS. Exploitable without authentication on the client registration endpoint.
  • CVE-2026-9801 — Malformed PasswordPolicyControl in LDAP federation requests causes a DoS on the LDAP subsystem.

Infrastructure and dependencies

  • CVE-2026-4800 — Code injection in lodash via _.template in the Account UI. Exploitable if user-controlled input reaches the template renderer.
  • CVE-2026-42581 — HTTP/1.0 TE+CL header combination in Netty bypasses request smuggling sanitization.
  • CVE-2026-9794 — SAML ECP faultstring discloses whether a given client ID exists in the realm.

This release also upgrades to Quarkus 3.33.2 and fixes 26 additional bugs including CORS handling issues and async migration edge cases.

Migration changes

This release includes breaking changes. Before upgrading, check the official migration guide.

Should you update?

Yes. CVE-2026-9704 (privilege escalation) and CVE-2026-4874 (SSRF) are the two to focus on first — both are exploitable by authenticated users and could result in unauthorized access to internal resources or elevated token privileges. CVE-2026-9802 (refresh token reuse) is particularly relevant for high-security environments that rely on token rotation as a session control mechanism.

Full release notes: keycloak.org/2026/06/keycloak-2663-released

At IDPTrust we specialize in Keycloak in production. If you need help assessing the impact of this release on your setup or planning the upgrade, get in touch.