CVE-2026-4325

Keycloak: keycloak: replay of action tokens via improper handling of single-use entries

Summary

Original description

The description as published by the source.

A flaw was found in Keycloak. The SingleUseObjectProvider, a global key-value store, lacks proper type and namespace isolation. This vulnerability allows an attacker to delete arbitrary single-use entries, which can enable the replay of consumed action tokens, such as password reset links. This could lead to unauthorized access or account compromise.

Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV

Affected packages

Bitnami keycloak

[{"type":"SEMVER","events":[{"introduced":"26.2.0"},{"fixed":"26.2.1"},{"introduced":"26.2.15"},{"fixed":"26.3.0"},{"introduced":"26.4.0"},{"fixed":"26.4.1"},{"introduced":"26.4.11"},{"fixed":"26.5.0"}]}]

References

advisory access.redhat.com
advisory access.redhat.com
advisory access.redhat.com
advisory access.redhat.com
advisory access.redhat.com
advisory bugzilla.redhat.com
web nvd.nist.gov