CVE-2026-9795High· 7.3▾ TwilightKeycloak has privilege escalation via improper scope mapping enforcement
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 40.2 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 30.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via GHSA
0.4%
0.4% → 0.5%
A flaw was found in Keycloak's Fine-Grained Admin Permissions (FGAPv2) feature. An administrator with limited client management permissions can exploit this vulnerability to assign any realm role, including highly privileged roles, to a client's scope mapping. This bypasses intended security controls, allowing the injected role to be projected into a user's authentication token when they access the modified client. This could lead to unauthorized privilege escalation within the Keycloak realm.
org.keycloak:keycloak-services < 26.6.4Upgrade to a patched release:
org.keycloak:keycloak-services 26.6.4Connected by shared product, vendor, weakness, or advisory.
CVE-2026-4633Low· 3.7Keycloak's identity-first login flow exposes user information
CVE-2026-37980Medium· 6.9Keycloak: Arbitrary code execution via Stored Cross-Site Scripting (XSS) in organization selection login page
CVE-2026-4628Medium· 4.3Keycloak has Improper Access Control that allows attackers with valid credentials to bypass the allowRemoteResourceManagement=false
GHSA-wmxr-6j5f-838pHigh· 7.7Duplicate Advisory: Keycloak: Unauthorized access via improper validation of encrypted SAML assertions
CVE-2026-90997High· 7.4A flaw was found in Keycloak
CVE-2024-32507High· 8.8WordPress Login with phone number plugin <= 1.7.16 - Privilege Escalation vulnerability