Nixpkgs security tracker

Login with GitHub

⚠️ You are using a production deployment that is still only suitable for demo purposes. Any work done in this might be wiped later without notice.

Suggestions search

All statuses

Filter by:

With package: keycloak-config-cli

Found 1 matching suggestions

View:

Compact

Detailed

Untriaged

Permalink CVE-2026-1609

8.1 HIGH

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): Low (L)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): High (H)
Integrity (I): High (H)
Availability (A): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): High (H)
Modified Availability (MA): None (N)

created 1 month, 1 week ago Activity log

Created suggestion 1 month, 1 week ago

Org.keycloak/keycloak-quarkus-server: keycloak: unauthorized access via jwt authorization grant with disabled users

A flaw was found in Keycloak. When the JSON Web Token (JWT) authorization grant preview feature is enabled and a user account is disabled, Keycloak fails to validate the user’s disabled status during JWT authorization grant processing. A remote attacker with low privileges can exploit this improper access control vulnerability by presenting a valid assertion token from an external identity provider to obtain a JWT for a disabled user. This allows unauthorized access to sensitive resources.

References

https://access.redhat.com/security/cve/CVE-2026-1609 x_refsource_REDHATvdb-entry
RHBZ#2435257 x_refsource_REDHATissue-tracking
https://github.com/keycloak/keycloak/issues/46144
https://github.com/keycloak/keycloak/releases/tag/26.5.3
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-1609.json x_sadp-csaf-vex

Affected products

Keycloak

<26.5.3

keycloak-quarkus-server

keycloak-quarkus-server-app

keycloak-quarkus-server-deployment

Matching in nixpkgs

pkgs.keycloak

Identity and access management for modern applications and services

nixos-unstable -
- nixos-unstable-small 26.7.0
nixos-26.05 -
- nixos-26.05-small 26.7.0

pkgs.keycloak-config-cli

Import YAML/JSON-formatted configuration files into Keycloak

nixos-unstable -
- nixos-unstable-small 6.5.1
nixos-26.05 -
- nixos-26.05-small 6.4.0

pkgs.terraform-providers.keycloak

None

nixos-unstable 5.8.0
nixos-26.05 -
- nixos-26.05-small 5.7.0

pkgs.python313Packages.python-keycloak

Provides access to the Keycloak API

nixos-unstable -
- nixos-unstable-small 7.1.1
nixos-26.05 -
- nixos-26.05-small 7.0.2

pkgs.python314Packages.python-keycloak

Provides access to the Keycloak API

nixos-unstable -
- nixos-unstable-small 7.1.1
nixos-26.05 -
- nixos-26.05-small 7.0.2

pkgs.terraform-providers.keycloak_keycloak

None

nixos-unstable -
- nixos-unstable-small 5.8.0
nixos-26.05 -
- nixos-26.05-small 5.7.0

Package maintainers

@leona-ya Leona Maroni <nix@leona.is>
@NickCao Nick Cao <nickcao@nichi.co>
@ngerstle Nicholas Gerstle <ngerstle@gmail.com>
@ap-1 Anish Pallati <i@anish.land>
@talyz Kim Lindberger <kim.lindberger@gmail.com>
@jefferyoo Jeffery Oo <oojefferywm@proton.me>
@kritdass Krit Dass <dasskrit@gmail.com>
@vitorpavani Vitor Pavan <vipavani@hotmail.com>

1