CVE-2026-112208High· 8.1▾ TwilightA flaw was found in the Organization identity-first login flow of the Keycloak authentication server. Keycloak is an open-source identity and access management solution used to secure modern applications and services. The issue occurs wh…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 44.6 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
A flaw was found in the Organization identity-first login flow of the Keycloak authentication server. Keycloak is an open-source identity and access management solution used to secure modern applications and services. The issue occurs when an attacker who belongs to multiple organizations initiates a login and then switches to a registration or password reset path. During this process, a flag indicating a successful login is not properly cleared when the user is removed from the session. An attacker can then provide a victim's username, and the system incorrectly treats the stale flag as proof of the victim's identity. This allows the attacker to bypass authentication and gain full access to the victim's account and connected applications.
keycloak-servicesrhbk/keycloak-rhel9keycloak-servicesRefer to the linked advisories for vendor-supplied fixes and affected version ranges.
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-18207Medium· 6.5Keycloak-services: keycloak-services: client policy source-group condition bypass via duplicate group name matching
CVE-2026-19608Medium· 5.3Keycloak-services: keycloak-services: name-only group claims let same-name groups satisfy path-specific group policies
CVE-2026-109081Medium· 6.8Keycloak-services: keycloak-services: injection of roles into realm default-roles via dcr endpoint
CVE-2026-107124Medium· 6.4Keycloak-services: keycloak-services: oidc logout endpoint session fixation via id_token_hint leading to account takeover
CVE-2026-96447Medium· 4.2Keycloak-services: keycloak-services: stateless token preferred_username fallback enables identity rebinding
CVE-2026-19688Medium· 6.8Keycloak-services: keycloak-services: admin api missing audience check