CVE-2026-9792

MediumCVSS 6.5/10Last modified Jun 26, 2026

Description

A flaw was found in Keycloak's Client Policies, specifically within the `org.keycloak.protocol.oidc` component. When certain condition providers (client-type, client-roles, client-attributes, client-scopes) are used to enforce security restrictions, the `reject-ropc-grant` executor is silently bypassed. This allows an unauthenticated remote attacker to obtain tokens via a Resource Owner Password Credentials (ROPC) grant, even when a policy is explicitly configured to block it. This bypass can lead to unauthorized access and information disclosure.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-280

Affected software

No affected versions have been published.

Timeline

Published
May 28, 2026
Last modified
Jun 26, 2026
NVD status
Modified

Related CVEs from 2026

CVE-2026-97920In the Linux kernel, the following vulnerability has been resolved: tracing: Keep the entry count when the histogram stats allocation failsCVE-2026-97921In the Linux kernel, the following vulnerability has been resolved: tracing: Free histogram the field rejected for a bad modifier Writing CVE-2026-97922In the Linux kernel, the following vulnerability has been resolved: tracing: Free histogram var refs regardless of how often they are referCVE-2026-97923In the Linux kernel, the following vulnerability has been resolved: tracing: Free histogram the var ref when its initialization fails creaCVE-2026-97924In the Linux kernel, the following vulnerability has been resolved: tracing/user_events: Don't destroy fields when event removal fails desCVE-2026-97925In the Linux kernel, the following vulnerability has been resolved: tick/broadcast: Plug clockevents replacement race 朱恺乾 reported and decCVE-2026-979267.0In the Linux kernel, the following vulnerability has been resolved: ufs: validate cylinder group metadata before caching it ufs_read_cylinCVE-2026-97927In the Linux kernel, the following vulnerability has been resolved: ufs: create the root dentry after loading cylinder metadata ufs_fill_sCVE-2026-97928In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: skip the VMID 0 flush for VRAM Clear-on-release only runs CVE-2026-97929In the Linux kernel, the following vulnerability has been resolved: ALSA: usbusx2y: validate URB actual_length in interrupt callback i_usxCVE-2026-97937.5A flaw was found in Keycloak. When a JSON Web Encryption (JWE) encrypted request object is submitted, Keycloak may incorrectly process unsigCVE-2026-97930In the Linux kernel, the following vulnerability has been resolved: ALSA: usbusx2y: fix in04_last array size mismatch with in04_buf The in
CVE-2026-9792: Medium severity, CVSS 6.5 | Vulnix