CVE-2026-4325: Keycloak: keycloak: replay of action tokens via improper handling of single-use entries

Severity: medium (CVSS 5.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-04-02 · updated 2026-10-26
Weakness: CWE-653

Description

A flaw was found in Keycloak. The SingleUseObjectProvider, a global key-value store, lacks proper type and namespace isolation. This vulnerability allows an attacker to delete arbitrary single-use entries, which can enable the replay of consumed action tokens, such as password reset links. This could lead to unauthorized access or account compromise.

Affected products

Red Hat build of Keycloak 26.4: 26.2, 26.2.15, 26.4, 26.4.11

References

https://access.redhat.com/errata/RHSA-2026:6475
https://access.redhat.com/errata/RHSA-2026:6476
https://access.redhat.com/errata/RHSA-2026:6477
https://access.redhat.com/errata/RHSA-2026:6478
https://access.redhat.com/security/cve/CVE-2026-4325
https://bugzilla.redhat.com/show_bug.cgi?id=2448351

Get alerted when CVE-2026-4325 or the next vulnerability affects your stack