Cyber Resilience

CVE-2026-4325

Redhat Build Of Keycloak 26.2 … 26.4.11

Published
02 April 2026
Modified
16 April 2026
Patch / advisory
View advisory
CVSS Score v3.1 5.3
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N
EPSS Score 0.0025 17th percentile
Risk Priority 35 floored blend · peak EPSS

Summary

CVE-2026-4325 is a medium-severity Improper Isolation or Compartmentalization (CWE-653) vulnerability in Redhat Build Of Keycloak. Its CVSS base score is 5.3 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Valid Accounts (T1078); ranked at the 17th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and SC-3 (Security Function Isolation) — see the control section below for these in your framework.

OWASP Top 10 for Web (2025)

A06:2025 Insecure Design

EU & UK References

Vulnerability Data

A flaw was found in Keycloak. The SingleUseObjectProvider, a global key-value store, lacks proper type and namespace isolation. This vulnerability allows an attacker to delete arbitrary single-use entries, which can enable the replay of consumed action tokens, such as password…

more

reset links. This could lead to unauthorized access or account compromise.

CWE(s)
CWE-653

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1078 Valid Accounts Stealth
Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion.
attack.mitre.org →
T1556 Modify Authentication Process Defense Impairment
Adversaries may modify authentication mechanisms and processes to access user credentials or enable otherwise unwarranted access to accounts.
attack.mitre.org →
Why these techniques?

Vulnerability bypasses single-use token enforcement in Keycloak auth flows, directly enabling replay of action tokens for account access (T1078 Valid Accounts) and manipulation of authentication mechanisms (T1556 Modify Authentication Process).

Confidence: MEDIUM · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2026-4282Same product: Redhat Build Of Keycloak
CVE-2026-8922Same product: Redhat Build Of Keycloak
CVE-2026-12388Same product: Redhat Build Of Keycloak
CVE-2026-9802Same product: Redhat Build Of Keycloak
CVE-2026-9799Same product: Redhat Build Of Keycloak
CVE-2026-9793Same product: Redhat Build Of Keycloak
CVE-2024-7318Same product: Redhat Build Of Keycloak
CVE-2026-4628Same product: Redhat Build Of Keycloak
CVE-2026-37982Same product: Redhat Build Of Keycloak
CVE-2026-3911Same product: Redhat Build Of Keycloak

Affected Assets

redhat
build of keycloak
26.2, 26.2.15, 26.4, 26.4.11, all versions

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)
  • AC-3 Access Enforcement
  • SC-3 Security Function Isolation
  • AC-4 Information Flow Enforcement
Detect
Catch it (NIST detect / respond)

—

Harden
Shrink the surface (DISA STIG)
  • 8 hardening rules · 7 OS baselines
Validate
Prove the fix (OWASP ASVS)

—

Mitigating Controls (NIST 800-53 r5) AI

AC-3 Access Enforcement good match
prevent

Directly enforces namespace- and type-specific access rules on the SingleUseObjectProvider so that only authorized operations on specific token entries are permitted, blocking arbitrary deletion.

SC-3 Security Function Isolation good match
prevent

Requires isolation of the single-use token store's security functions and data structures, preventing the global KV store from allowing cross-namespace or cross-type interference that enables token replay.

AC-4 Information Flow Enforcement partial match
prevent

Enforces information-flow policies between distinct token namespaces/types inside the provider, stopping unauthorized deletion or reuse of consumed action tokens across compartment boundaries.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.AA-05 full match
prevents

Least-privilege policy directly enforces separation of privilege levels and access rights.

PR.IR-01 mostly match
prevents

Network and environment segmentation implements the isolation required to prevent unauthorized cross-compartment access.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.5.3 Segregation of duties mostly match
degrades

Segregation of duties directly enforces separation of privilege levels and functions.

A.8.22 Segregation of networks mostly match
prevents

Network segregation is a classic technical control for isolating different privilege domains.

A.8.27 Secure system architecture and engineering principles mostly match
prevents

Secure system architecture principles explicitly call for isolation and least-privilege boundaries.

A.8.31 Separation of development, test and production environments mostly match
prevents

Separation of development, test and production environments is a direct application of compartmentalization.

A.5.15 Access control partial match
degrades

Access control policies establish the boundaries that isolation must enforce.

A.5.18 Access rights partial match
degrades

Managing access rights is the operational mechanism for compartmentalizing privileges.

References