Keycloak: keycloak: Wiederholung von Aktionstoken durch unsachgemäße Behandlung von Single-Use-Einträgen

The core of the impact lies in the ability to replay action tokens. Consider a scenario where a user initiates a password reset. Keycloak generates a unique, single-use token to verify the user's identity during the reset process. CVE-2026-4325 allows an attacker to delete this token after it has been consumed by the legitimate user, but before the reset process is complete. This effectively allows the attacker to generate a new, valid token using the same identifier, bypassing the intended security mechanism. The attacker could then use this replayed token to reset the user's password, gaining unauthorized access to their account. The blast radius extends to any user who has recently initiated an action requiring a single-use token, such as password resets, multi-factor authentication enrollment, or other similar workflows. Data at risk includes user credentials, personal information, and access to sensitive resources controlled by Keycloak.

1. Reserviert2026-03-17
2. Veröffentlicht2026-04-02
3. Geändert2026-04-07
4. EPSS aktualisiert2026-04-10

The primary mitigation for CVE-2026-4325 is to upgrade to a patched version of Keycloak. The vendor has not yet specified a fixed version, so monitor Keycloak's security advisories for updates. Until the upgrade is possible, consider implementing temporary workarounds. One approach is to shorten the lifespan of single-use tokens to minimize the window of opportunity for exploitation. Another is to implement stricter validation checks on token usage, ensuring that tokens are only valid for a single use and within a limited timeframe. While not a direct fix, implementing Web Application Firewall (WAF) rules to detect and block suspicious token manipulation attempts can provide an additional layer of defense. Detection signatures, such as Sigma rules or YARA patterns, can be developed to identify malicious activity targeting the SingleUseObjectProvider, but their effectiveness will depend on the attacker's techniques.