Dashboard / CVE-2026-4634

CVE-2026-4634

INFO Priority: 0.00 BB Relevance: 0/100
Published: 2026-04-02 Modified: 2026-10-26 First seen: 2026-10-29 Status: pending_score

Description

A flaw was found in Keycloak. An unauthenticated attacker can exploit this vulnerability by sending a specially crafted POST request with an excessively long scope parameter to the OpenID Connect (OIDC) token endpoint. This leads to high resource consumption and prolonged processing times, ultimately resulting in a Denial of Service (DoS) for the Keycloak server.

Weakness Classification (1)

Affected Software (5)

VendorProductVersion
redhat build_of_keycloak -
redhat build_of_keycloak 26.2
redhat build_of_keycloak 26.2.15
redhat build_of_keycloak 26.4
redhat build_of_keycloak 26.4.11

References & Advisories (12)

Bug Bounty Relevance

0 / 100

CVSS Score

Unscored

EPSS — Exploitation Probability

0.63%
Raw Score 0.006270
Percentile 49.9%
Date 2026-10-29

EPSS Trend

2026-10-29
0.00627
2026-10-28
0.00627

Intelligence Sources

nvd ref →

External Links