fix(deps): update dependency org.keycloak:keycloak-services to v26.6.1 [security]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
org.keycloak:keycloak-services (source)	26.6.0 → 26.6.1

---

Keycloak Server-Side Request Forgery via OIDC token endpoint manipulation

CVE-2026-4874 / GHSA-22rm-wp4x-v5cx

More information

Details

A flaw was found in Keycloak. An authenticated attacker can perform Server-Side Request Forgery (SSRF) by manipulating the client_session_host parameter during refresh token requests. This occurs when a Keycloak client is configured to use the backchannel.logout.url with the application.session.host placeholder. Successful exploitation allows the attacker to make HTTP requests from the Keycloak server’s network context, potentially probing internal networks or internal APIs, leading to information disclosure.

Severity

• CVSS Score: 3.1 / 10 (Low)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2026-4874
• https://access.redhat.com/security/cve/CVE-2026-4874
• https://bugzilla.redhat.com/show_bug.cgi?id=2451611
• https://github.com/keycloak/keycloak

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Keycloak has Improper Access Control that allows attackers with valid credentials to bypass the allowRemoteResourceManagement=false

CVE-2026-4628 / GHSA-4pgc-gfrr-wcmg

More information

Details

A flaw was found in Keycloak. An improper Access Control vulnerability in Keycloak’s User-Managed Access (UMA) resource_set endpoint allows attackers with valid credentials to bypass the allowRemoteResourceManagement=false restriction. This occurs due to incomplete enforcement of access control checks on PUT operations to the resource_set endpoint. This issue enables unauthorized modification of protected resources, impacting data integrity.

Severity

• CVSS Score: 4.3 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2026-4628
• https://access.redhat.com/security/cve/CVE-2026-4628
• https://bugzilla.redhat.com/show_bug.cgi?id=2450240
• https://github.com/keycloak/keycloak

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

keycloak/keycloak (org.keycloak:keycloak-services)

v26.6.1

Compare Source

---

Configuration

📅 Schedule: (in timezone US/Eastern)

• Branch creation
  • ""
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.