Dashboard / CVE-2026-4325

CVE-2026-4325

MEDIUM
MEDIUM Priority: 0.01 BB Relevance: 51/100
Published: 2026-04-02 Modified: 2026-10-26 First seen: 2026-10-29 Status: active

Attack Surface

Network No Auth Integ. Impact

CVSS Vector Breakdown

AV: Network
AC: High
PR: None
UI: Required
S: Unchanged
C: None
I: High
A: None

Description

A flaw was found in Keycloak. The SingleUseObjectProvider, a global key-value store, lacks proper type and namespace isolation. This vulnerability allows an attacker to delete arbitrary single-use entries, which can enable the replay of consumed action tokens, such as password reset links. This could lead to unauthorized access or account compromise.

Weakness Classification (1)

Affected Software (5)

VendorProductVersion
redhat build_of_keycloak -
redhat build_of_keycloak 26.2
redhat build_of_keycloak 26.2.15
redhat build_of_keycloak 26.4
redhat build_of_keycloak 26.4.11

References & Advisories (6)

Bug Bounty Relevance

51 / 100
✓ Network accessible
✓ No authentication

CVSS Score

5.3 / 10.0 v3.1
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N

EPSS — Exploitation Probability

0.25%
Raw Score 0.002500
Percentile 16.4%
Date 2026-10-29

EPSS Trend

2026-10-29
0.00250
2026-10-28
0.00250

Intelligence Sources

nvd ref →

External Links