CVE-2026-4325CWE-653

Keycloak: keycloak: replay of action tokens via improper handling of single-use entries

Medium · published April 2, 2026

CVSS v3.1
5.3
EPSS
0%
Percentile
34.5
In the wild
Unconfirmed
What it is

A flaw was found in Keycloak. The SingleUseObjectProvider, a global key-value store, lacks proper type and namespace isolation. This vulnerability allows an attacker to delete arbitrary single-use entries, which can enable the replay of consumed action tokens, such as password reset links. This could lead to unauthorized access or account compromise.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00413 · 34.5th percentile
Weakness
CWE-653 · Improper Isolation or Compartmentalization
Published
2026-04-02T12:44Z
EPSS history
Timeline
  • 02 APR 12:44Z
    Keycloak: keycloak: replay of action tokens via improper handling of single-use entries
    cvelistv5