Disclaimer: Some of the CVEs referenced below have not yet been publicly disclosed, so details regarding their severity, impact, and potential attack vectors are not fully available at this time. This post will be updated as soon as additional information becomes available.
Important: Keycloak security update
Type/Severity
NetEye Product Security has rated this update as having a CRITICAL security impact.
Topic
An update for the keycloak packages is now available for NetEye 4.
Security Fix for NetEye 4.50:
26.8.2_neteye1.47.3-1
CVEs
- CVE-2026-117691
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N - CVE-2026-111497
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVE-2026-92358
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N - CVE-2026-105305
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N - CVE-2026-107623
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N - CVE-2026-107889
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N - CVE-2026-112208
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N - CVE-2026-110932
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - CVE-2026-107123
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - CVE-2026-107602
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - CVE-2026-110931
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - CVE-2026-97174
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N - CVE-2026-114232
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N - CVE-2026-97847
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L - CVE-2026-93998
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N - CVE-2026-96453
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N - CVE-2026-92857
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N - CVE-2026-103112
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H - CVE-2026-97175
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - CVE-2026-82965
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - CVE-2026-96448
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H - CVE-2026-92855
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N - CVE-2026-112201
- CVE-2026-107124
- CVE-2026-97367
- CVE-2026-96547
- CVE-2026-96457
- CVE-2026-96460
- CVE-2026-97848
- CVE-2026-109081
- CVE-2026-96447
- CVE-2026-92856
- CVE-2026-19688
The most severe of the 33 CVEs is a signature bypass in the SAML identity broker’s HTTP-Redirect binding. A percent-encoded parameter name (%53AMLResponse) lets an unauthenticated attacker log in as any user. It is followed by an Out-of-bounds Write in the bundled Brotli decoder, which can lead to remote code execution.
Eight CVEs enable account or session takeover: a stale SSO_AUTH note in Organization identity-first login, an authentication race condition, automatic linking of unverified identity-provider emails, a cross-browser account-linking proof that survives a successful link and a later self-service unlink, sub parameter injection in CIBA, logout with an injected id_token_hint, azp/sid claim substitution through Dynamic Client Registration (DCR), and a preferred_username fallback for stateless tokens that rebinds identities after a client is recreated.
Three further CVEs let DCR-registered protocol mappers forge reserved token claims: sub and aud, realm_access.roles taken from user-editable attributes, and duplicate resource_access claims through mappers with jsonType=JSON (an incomplete fix of CVE-2026-16102).
Furthermore, a group of Missing or Incorrect Authorization flaws allows privilege escalation: a client manager can replace a sessionless token principal and take over the realm, a principal holding only create-client can inject a role into the realm default roles, GAP v2 composite-blind role mapping lets manage-users assign a role that wraps realm-admin, a group-admin DENY can be bypassed through a top-level group move (a regression of CVE-2026-9099), UMA permissions can grant access to other owners’ resources, the Admin API has no audience check, tokens issued by token exchange can have unlimited expiration, the Device Authorization Grant bypasses per-client minimum.acr.value, and a DCR read-modify-write silently disables offline-token revocation on backchannel logout.
Three SAML flaws affect trust decisions: the SAML adapter accepts assertions from the wrong configured issuer, and the SAML broker accepts Holder-of-Key assertions without proof of key possession and ignores ProxyRestriction.
Six issues cause unauthenticated denial of service or affect resource handling: a crafted request to the SAML endpoint, infinite loops in the SAML 1.1 KeyInfo and AuthorityBinding parsers (the latter can terminate the JVM with a single request and is an incomplete fix of CVE-2026-7307), unbounded XML parsing on the SAML SOAP resolve endpoint, persistent disk exhaustion through the theme gzip cache, and a login-failure upsert that trusts the affected-row count returned by MySQL/MariaDB.
Finally, the remaining CVEs are a stored XSS on the login page via a kcSanitize bypass, and custom truststores in kcadm that trust arbitrary self-signed certificates.
Together, these CVEs can lead to remote code execution, authentication bypass, account takeover, privilege escalation to realm administrator, or denial of service.
Affected Products
All NetEye 4.x versions >= 4.38
References
- https://neteye.guide/current/security-policy/bugfix-policy.html#severity-levels
- https://github.com/keycloak/keycloak/releases/tag/26.8.2
- https://github.com/advisories/GHSA-c85j-3hq2-q6wj
- https://github.com/advisories/GHSA-9v8h-qqgm-4m35
- https://github.com/advisories/GHSA-prm3-wvj6-64vx
- https://github.com/advisories/GHSA-ggxp-hq23-v84f
- https://github.com/advisories/GHSA-qxj8-968q-qm7w
- https://github.com/advisories/GHSA-gv8g-wx99-6r59
- https://github.com/advisories/GHSA-r493-gfv4-ggf5
- https://github.com/advisories/GHSA-pm5j-69hm-5c3g
- https://github.com/advisories/GHSA-85r4-9fq8-q8x4
- https://github.com/advisories/GHSA-pv56-v62v-px29
- https://github.com/advisories/GHSA-w9c8-6pxq-5xf8
- https://github.com/advisories/GHSA-42wm-mqj8-5cwr
- https://github.com/advisories/GHSA-9xcc-hxhx-vp63
- https://github.com/advisories/GHSA-8jjf-j496-4j4c
- https://github.com/advisories/GHSA-rxhm-ghrc-q7h4
- https://github.com/advisories/GHSA-p934-9hpw-698j
- https://github.com/advisories/GHSA-xw5c-j6m6-2hxj
- https://github.com/advisories/GHSA-vv23-h6x5-hjjh
- https://github.com/advisories/GHSA-9gcf-99g8-425c
- https://github.com/advisories/GHSA-8pp2-6pp7-q768
- https://github.com/advisories/GHSA-x6m6-7qg7-7r64
- https://github.com/advisories/GHSA-486h-gxch-8c4x
Patrick Harasser
Author
