Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.9
Keycloak could let attackers bypass access controls
published 5 days ago
Summary
The Keycloak identity management software has a security weakness that could let unauthorized users gain access to protected resources. The issue is fixed in newer versions, so updating to the latest release is recommended.
What to do
- Update cleanstart keycloak to version 26.5.0-r1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| CleanStart | cleanstart | keycloak |
< 26.5.0-r1 Fix: upgrade to 26.5.0-r1
|
Original advisory text
Security fix for GHSA-5rfx-cp42-p624 applied in: keycloak 26.5.0-r1
Security vulnerability affects the keycloak package. This issue is resolved in later releases. See references for vulnerability details.
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker partial control (estimated)
Timeline
Published30 Oct 2026
Updated31 Oct 2026
First seen31 Oct 2026
Sources
CLEANSTART-2026-DV89526 · OSV
Track software like this
Free during beta