VulnSocial

CVE-2026-9792General(redhat / build_of_keycloak)

LOWCVSS 6.5 · MEDIUM

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch redhat build_of_keycloak systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

A flaw was found in Keycloak's Client Policies, specifically within the `org.keycloak.protocol.oidc` component. When certain condition providers (client-type, client-roles, client-attributes, client-scopes) are used to enforce security restrictions, the `reject-ropc-grant` executor is silently bypassed. This allows an unauthenticated remote attacker to obtain tokens via a Resource Owner Password Credentials (ROPC) grant, even when a policy is explicitly configured to block it. This bypass can lead to unauthorized access and information disclosure.

redhat CVEsBack to dashboard
0.5/ 10 priority

Sources & remediation

Vendor / third-party advisories
Other references
Weakness type (CWE)
CWE-280

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • build_of_keycloak

Threat summary

  • Patch or workaround signal is available
  • 2 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 1 signal
  • General: 1 classified signal
  • Peaked 1d ago at 1 mentions (2026-05-28); latest day: 1
  • 2 total mentions across 2 days

Affected systems

Vendors
redhat
Products
build_of_keycloak

1 version affected across 1 product

Deep dive

Activity timeline2 mentions / 2d
00111Mentions · 2026-05-28: 1Mentions · 2026-08-18: 1Patch / Workaround · 2026-08-18: 105-2808-18
Signal classification2 categories
General
150.0%
Patch
150.0%
Referenced assets5 URLs
Classification over time
DateTotalLabels
2026-05-281
General1
2026-08-181
Patch1
Full discourse2 posts
  • White Rabbitx 🏴‍☠️@TheRabbitPy
    General

    More Keycloak flaws impact SAML, JWE handling, OIDC policies, and data exposure. Attackers can enumerate clients, bypass signature enforcement, evade client policy restrictions, and leak organization metadata. Also: Acer NitroSense LPE via weak named pipe ACL. CVE-2026-9794 https://nvd.nist.gov/vuln/detail/CVE-2026-9794 CVE-2026-9793 https://nvd.nist.gov/vuln/detail/CVE-2026-9793 CVE-2026-9792 https://nvd.nist.gov/vuln/detail/CVE-2026-9792 CVE-2026-9791 https://nvd.nist.gov/vuln/detail/CVE-2026-9791 CVE-2026-9789 https://nvd.nist.gov/vuln/detail/CVE-2026-9789

    Post summary

    The post lists several Keycloak CVEs and briefly notes their impact on authentication protocols, but provides no PoC, exploit code, active exploitation evidence, patches, or detailed technical specifics.

    1003091
    1.8K followersView on X
  • Guillaume@gxlmo
    Patch

    @laurent30803127 @grinchmaster168 @LaurenIpsu31127 @Projet_Arcadie C'est vrai 🤣 D'où le fait de mettre son idp à jour, keycloak en a fait les frais (cve-2026-9792).

    Post summary

    The user notes that a Keycloak IDP required an update due to CVE-2026-9792, indicating that a patch or update was applied to mitigate the vulnerability.

    0001090
    621 followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Appredhatbuild_of_keycloak---

Explore more

Back to dashboardredhat CVEsbuild_of_keycloak vulnerabilities