CVE-2026-4634

[CVE catalog]

Severity

High · CVSS 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Published

Apr 2, 2026, 12:30:00 PM UTC

Source

[NVD] · [CVE record]

EPSS

0.63% · Oct 25, 2026

A flaw was found in Keycloak. An unauthenticated attacker can exploit this vulnerability by sending a specially crafted POST request with an excessively long scope parameter to the OpenID Connect (OIDC) token endpoint. This leads to high resource consumption and prolonged processing times, ultimately resulting in a Denial of Service (DoS) for the Keycloak server. keycloak: Keycloak: Denial of Service via excessive processing of OpenID Connect scope parameters This is an Important denial of service vulnerability in Red Hat Build of Keycloak (RHBK). An unauthenticated attacker can exploit this flaw by sending a specially crafted POST request with an excessively long scope parameter to the OpenID Connect token endpoint, leading to high resource consumption and prolonged processing times on the Keycloak server. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.