Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.3
Keycloak may expose encrypted data due to Bouncy Castle issue
published 5 days ago
Summary
The Keycloak authentication system uses the Bouncy Castle cryptography library, and older versions of that library contain a weakness that could let an attacker read or alter encrypted information. This can compromise user credentials and session tokens. Update the Bouncy Castle library to the latest version or apply the vendor’s recommended patch to secure Keycloak.
What to do
- Update cleanstart keycloak to version 26.4.13-r1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| CleanStart | cleanstart | keycloak |
< 26.4.13-r1 Fix: upgrade to 26.4.13-r1
|
Original advisory text
In Bouncy Castle for Java before 1
Security vulnerability affects the keycloak package. In Bouncy Castle for Java before 1.
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker partial control (estimated)
Timeline
Published30 Oct 2026
Updated31 Oct 2026
First seen31 Oct 2026
Sources
CLEANSTART-2026-GC03166 · OSV
Track software like this
Free during beta