CVE-2026-4325: Keycloak Auth Bypass Vulnerability

CVE-2026-4325 Overview

A security flaw has been discovered in Keycloak affecting the SingleUseObjectProvider component. This global key-value store implementation lacks proper type and namespace isolation, creating a vulnerability that allows attackers to delete arbitrary single-use entries. By exploiting this weakness, malicious actors can enable the replay of consumed action tokens, such as password reset links, potentially leading to unauthorized access or complete account compromise.

Critical Impact

Attackers can replay consumed action tokens including password reset links, potentially gaining unauthorized access to user accounts or enabling account takeover scenarios.

Affected Products

• Keycloak (specific versions detailed in Red Hat Security Advisories)
• Red Hat Single Sign-On (related products covered under RHSA advisories)

Discovery Timeline

• April 2, 2026 - CVE-2026-4325 published to NVD
• April 2, 2026 - Last updated in NVD database

Technical Details for CVE-2026-4325

Vulnerability Analysis

The vulnerability resides in Keycloak's SingleUseObjectProvider, which serves as a global key-value store for managing single-use tokens throughout the authentication system. The fundamental issue stems from improper isolation between different types and namespaces within this storage mechanism. When action tokens are generated—such as those used for password resets, email verification, or account linking—they are stored in this provider with the expectation that once consumed, they cannot be reused. However, due to the lack of proper namespace isolation, an attacker with knowledge of the token structure can manipulate the storage to delete entries associated with consumed tokens, effectively "restoring" them to a usable state.

This weakness is classified under CWE-653 (Improper Isolation or Compartmentalization), highlighting the core architectural issue where security boundaries between different token types and user contexts are not adequately enforced.

Root Cause

The root cause lies in the architectural design of the SingleUseObjectProvider implementation. The component fails to enforce proper compartmentalization between different types of single-use objects stored within the system. Without adequate type checking and namespace separation, the storage mechanism treats all entries uniformly, allowing cross-type operations that should be restricted. This design flaw enables attackers to target and delete specific entries from contexts they should not have access to, bypassing the intended single-use restriction on sensitive action tokens.

Attack Vector

The attack requires network access and involves user interaction, making it a targeted attack scenario. An attacker can exploit this vulnerability by:

1. Obtaining a valid action token (such as a password reset link) intended for a target user
2. Allowing the legitimate user to consume the token (e.g., completing the password reset)
3. Exploiting the namespace isolation flaw to delete the consumed token entry from the SingleUseObjectProvider
4. Replaying the previously consumed token to perform unauthorized actions

This attack is particularly dangerous in scenarios where password reset links or account recovery tokens are intercepted or shared, as the attacker can reuse these tokens even after the legitimate user has already utilized them.

Detection Methods for CVE-2026-4325

Indicators of Compromise

• Multiple successful password reset actions using the same token identifier within Keycloak logs
• Unusual deletion patterns in the SingleUseObjectProvider storage backend
• Authentication events occurring after action token expiration or consumption timestamps
• Anomalous account access patterns following password reset operations

Detection Strategies

• Monitor Keycloak audit logs for duplicate action token usage events
• Implement alerting for password reset completions followed by immediate account access from different IP addresses
• Track SingleUseObjectProvider storage operations for unauthorized deletion patterns
• Correlate authentication events with action token lifecycle to detect replay attempts

Monitoring Recommendations

• Enable comprehensive audit logging for all authentication and token-related events in Keycloak
• Configure SIEM rules to detect action token replay patterns based on token identifiers
• Monitor for multiple successful authentications or password changes using identical token references
• Establish baseline metrics for normal token consumption patterns to identify anomalies

How to Mitigate CVE-2026-4325

Immediate Actions Required

• Apply the latest security patches from Red Hat as referenced in the security advisories
• Review recent password reset and account recovery activities for signs of token replay
• Consider temporarily disabling or rate-limiting password reset functionality in high-risk environments
• Audit user accounts for unauthorized access following recent password reset operations

Patch Information

Red Hat has released multiple security advisories addressing this vulnerability. Organizations running affected Keycloak or Red Hat Single Sign-On deployments should apply the appropriate patches immediately:

• Red Hat Security Advisory RHSA-2026:6475
• Red Hat Security Advisory RHSA-2026:6476
• Red Hat Security Advisory RHSA-2026:6477
• Red Hat Security Advisory RHSA-2026:6478

For additional technical details, refer to the Red Hat CVE-2026-4325 Description and Red Hat Bugzilla Entry #2448351.

Workarounds

• Implement additional verification steps for password reset flows (e.g., multi-factor authentication)
• Reduce action token validity periods to minimize the window of exploitation
• Deploy network-level controls to limit access to Keycloak administrative and token endpoints
• Consider implementing custom token validation logic that cross-references consumed token records

# Example: Reduce password reset token validity in Keycloak realm configuration
# Access Keycloak Admin Console > Realm Settings > Tokens
# Set "Action Token Generated By User Lifespan" to a minimal acceptable value
# Example CLI configuration (adjust values based on your environment):
/opt/keycloak/bin/kcadm.sh update realms/master -s 'actionTokenGeneratedByUserLifespan=300'