{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0","last_affected":"26.4.7"},{"introduced":"26.5.0","last_affected":"26.6.4"}],"component":"org.keycloak:keycloak-services","cve_ids":["CVE-2026-9798"],"ecosystem":"Maven","epss":0.00375,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-q6h7-xxp7-7429","id":"tcs_01M5N98VXENS5WSECREYWSVJHY","modified_at":"2026-09-10T03:51:06.866862420Z","published_at":"2026-05-28T06:31:09Z","references":["https://osv.dev/vulnerability/GHSA-q6h7-xxp7-7429","https://nvd.nist.gov/vuln/detail/CVE-2026-9798","https://github.com/keycloak/keycloak/issues/49432","https://github.com/keycloak/keycloak/pull/49791","https://github.com/keycloak/keycloak/pull/49903","https://github.com/keycloak/keycloak/pull/49905","https://github.com/keycloak/keycloak/commit/11c2695064cd93da1d333df3f69d4a4141e86c29","https://github.com/keycloak/keycloak/commit/2edc6b112e2dedce63062b89ab3c7ae542e0d9ac","https://github.com/keycloak/keycloak/commit/a11e3254efc16ae72ce5092b93b9f557a4ba43ae","https://access.redhat.com/errata/RHSA-2026:50846","https://access.redhat.com/errata/RHSA-2026:50847","https://access.redhat.com/errata/RHSA-2026:50848","https://access.redhat.com/errata/RHSA-2026:50849","https://access.redhat.com/security/cve/CVE-2026-9798","https://bugzilla.redhat.com/show_bug.cgi?id=2482470","https://github.com/keycloak/keycloak"],"severity":{"label":"medium","score":4.3},"sources":[{"source":"osv","source_id":"GHSA-q6h7-xxp7-7429","url":"https://osv.dev/vulnerability/GHSA-q6h7-xxp7-7429"}],"summary":"Keycloak has an Authentication Bypass by Primary Weakness"}