CVE-2026-4634: 
Java vulnerability analysis and mitigation

CVE-2026-4634 is a Denial of Service (DoS) vulnerability in Keycloak's OpenID Connect (OIDC) token endpoint, caused by uncontrolled resource consumption when processing excessively long scope parameters. An unauthenticated attacker can send a specially crafted POST request to trigger high resource usage and prolonged processing times, effectively rendering the Keycloak server unavailable. The vulnerability was reported on March 23, 2026, publicly disclosed on April 2, 2026, and affects Keycloak versions prior to 26.5.7 (upstream) and Red Hat Build of Keycloak versions prior to 26.2.15 and 26.4.11. It carries a CVSS v3.1 base score of 7.5 (High) (Red Hat CVE, GitHub Advisory).

The root cause is an algorithmic complexity flaw (CWE-1050: Excessive Platform Resource Consumption within a Loop) in TokenManager.getRequestedClientScopes(). At line 658, the method performs a String.contains() check on the entire scope parameter string for each default client scope, resulting in O(n²) processing time as the scope string grows. A single POST request with approximately 49 KB of scope values causes ~38.6 seconds of server-side processing; with ~99 KB, processing time reaches ~151.8 seconds. The vulnerability affects not only Resource Owner Password Credentials (ROPC) grants but also client credential grants and token refreshes — critically, token refresh exploitation occurs before token validation, meaning any unauthenticated attacker can trigger it without valid credentials (Red Hat Bugzilla, GitHub Advisory).

Successful exploitation causes high CPU and resource consumption on the Keycloak server, leading to prolonged processing times and a complete Denial of Service condition for all legitimate users. Because Keycloak serves as a central authentication and single sign-on (SSO) provider, a DoS attack against it can cascade to all dependent applications and services that rely on it for authentication. There is no confidentiality or integrity impact — the vulnerability is limited to availability (Red Hat CVE, GitHub Advisory).

1. Reconnaissance: Identify internet-facing or network-accessible Keycloak instances running versions prior to 26.5.7 (upstream) or Red Hat Build of Keycloak prior to 26.2.15 / 26.4.11. Enumerate the OIDC token endpoint URL, typically at https://<keycloak-host>/realms/<realm>/protocol/openid-connect/token.
2. Generate oversized scope payload: Create an excessively long scope string, e.g., using Python: SCOPE=$(python3 -c "print(' '.join(['scope'+str(i) for i in range(5000)]))") — this produces approximately 49 KB of scope data.
3. Send crafted POST request: Submit the payload to the token endpoint using any grant type, such as ROPC or token refresh: curl -s -X POST "https://<keycloak-host>/realms/master/protocol/openid-connect/token" -d "grant_type=password&client_id=admin-cli&username=x&password=x&scope=<LONG_SCOPE>"
4. Amplify impact: Repeat the request in rapid succession (e.g., via a script or tool like ab or wrk) to exhaust server threads and CPU resources, causing the Keycloak server to become unresponsive to legitimate authentication requests.
5. Observe DoS: Legitimate users and applications are unable to authenticate, as the server is occupied processing the malicious requests (Red Hat Bugzilla).

• Network: High volume of POST requests to /realms/<realm>/protocol/openid-connect/token with unusually large request body sizes (tens of kilobytes in the scope parameter); requests originating from a single or small set of IP addresses in rapid succession.
• Logs: Keycloak server logs showing extremely long request processing times (tens to hundreds of seconds) for token endpoint requests; repeated authentication failures or timeouts logged for the token endpoint.
• Process/System: Sustained high CPU utilization on the Keycloak server process without a corresponding increase in legitimate user traffic; thread pool exhaustion or out-of-memory errors in Keycloak application logs.
• Application: Legitimate users reporting authentication failures or timeouts across all applications relying on the affected Keycloak realm (Red Hat Bugzilla).

Red Hat has released patches addressing this vulnerability: upgrade to Red Hat Build of Keycloak 26.2.15 (errata RHSA-2026:6475, RHSA-2026:6476) or 26.4.11 (errata RHSA-2026:6477, RHSA-2026:6478), issued April 16, 2026. For upstream Keycloak, upgrade to version 26.5.7 or later (GitHub Advisory). As a temporary workaround where immediate patching is not feasible, implement network-level controls (e.g., WAF rules or rate limiting) to restrict the size of POST request bodies or the scope parameter on the OIDC token endpoint, and monitor for anomalous processing times and resource consumption (Red Hat CVE).

The vulnerability received standard community attention upon disclosure, with mentions on Bluesky and Mastodon social platforms shortly after publication (Red Hat CVE). Red Hat classified the advisory as "Important" severity and issued multiple errata covering both standalone and OpenShift container deployments. No notable independent researcher commentary or significant media coverage beyond standard vulnerability tracking has been identified.