Skip to contentRed Hat Keycloak vulnerabilities
- keycloak keycloak-services, red hat build of keycloak, single sign-on 7 +2 moreKeycloak-services: keycloak-services: login-failure upsert trusts mysql/mariadb affected-row countCVE-2026-1122014.8 Medium
- red hat build of keycloak, single sign-on 7 +1 moreKeycloak-services: keycloak-services: delegated admin escalates to realm-admin via group moveCVE-2026-1164686.6 Medium
- red hat build of keycloak, single sign-on 7 +1 moreKeycloak-services: keycloak-services: client-level mandatory pkce bypass via login-actions entry pointCVE-2026-1256526.8 Medium
- red hat build of keycloak, single sign-on 7 +1 moreKeycloak-services: keycloak-services: manage-clients to arbitrary code execution through inline javascript policy importCVE-2026-1209849.1 Critical
- red hat build of keycloakKeycloak: keycloak: privilege escalation via client authentication manipulation by an authenticated administratorCVE-2026-97976.5 Medium
- red hat build of keycloak 26.4, build of keycloak 26.4.17, build of keycloak 26.6 +2 more +4 moreKeycloak-services: keycloak-services: protocol mapper with jsontype=json bypasses token sanitizationCVE-2026-978486.5 Medium
- red hat build of keycloak 26.4, build of keycloak 26.4.17, build of keycloak 26.6 +2 more +4 moreKeycloak-services: keycloak-services: dcr azp and sid claim substitution allows account rest session takeoverCVE-2026-973676.4 Medium
- red hat build of keycloak 26.4, build of keycloak 26.4.17, build of keycloak 26.6 +2 more +4 moreKeycloak-services: keycloak-services: dcr registration-time claim-path gap allows forging realm_access.rolesCVE-2026-965476.5 Medium
- red hat build of keycloak 26.6, build of keycloak 26.6.8, single sign-on 7 +2 moreKeycloak-services: keycloak-services: indefinite access token renewal via standard token exchange v2CVE-2026-964605.4 Medium
- red hat build of keycloak 26.6, build of keycloak 26.6.8, single sign-on 7 +2 moreKeycloak-services: keycloak-services: saml broker ignores proxyrestriction delegation constraintsCVE-2026-928564.9 Medium
- red hat build of keycloak 26.6, build of keycloak 26.6.8, single sign-on 7 +2 moreKeycloak-services: keycloak-services: admin api missing audience checkCVE-2026-196886.8 Medium
- red hat build of keycloak 26.6, build of keycloak 26.6.8, single sign-on 7 +2 moreKeycloak-services: keycloak-services: stateless token preferred_username fallback enables identity rebindingCVE-2026-964474.2 Medium
- red hat build of keycloak 26.6, build of keycloak 26.6.8, single sign-on 7 +2 moreKeycloak-services: keycloak-services: injection of roles into realm default-roles via dcr endpointCVE-2026-1090816.8 Medium
- red hat build of keycloak 26.6, build of keycloak 26.6.8, single sign-on 7 +2 moreKeycloak-services: keycloak-services: oidc logout endpoint session fixation via id_token_hint leading to account takeoverCVE-2026-1071246.4 Medium
- red hat build of keycloak 26.4, build of keycloak 26.4.17, build of keycloak 26.6 +2 more +4 moreKeycloak-services: keycloak-services: client manager can substitute sessionless token principal via hardcoded-claim mappers to obtain realm administrator authorityCVE-2026-978477.1 High
- red hat build of keycloak 26.4.17, build of keycloak 26.6.8, single sign-on 7 +2 moreKeycloak-services: keycloak-services: unverified idp email auto-linking enables account takeoverCVE-2026-971758.8 High
- red hat build of keycloak 26.6, build of keycloak 26.6.8, single sign-on 7 +2 moreKeycloak-services: keycloak-services: ciba sub parameter injection causes attacker authentication to issue victim tokensCVE-2026-971746.8 Medium
- red hat amq broker 7, build of keycloak 26.4, build of keycloak 26.4.17 +8 more +10 moreOrg.keycloak/keycloak-admin-cli: keycloak-admin-cli: kcadm custom truststore accepts arbitrary self-signed certificatesCVE-2026-964538.0 High
- red hat amq broker 7, build of keycloak 26.4, build of keycloak 26.4.17 +8 more +10 moreKeycloak-core: keycloak-core: saml adapter does not bind signed assertions to the configured identity provider issuerCVE-2026-939987.4 High
- red hat build of keycloak 26.4, build of keycloak 26.4.17, build of keycloak 26.6 +2 more +4 moreKeycloak-services: keycloak-services: dcr protocol mapper config not validated, allowing iat holders to forge sub and aud claims in signed tokensCVE-2026-928578.1 High
- red hat build of keycloak 26.4, build of keycloak 26.4.17, build of keycloak 26.6 +2 more +4 moreKeycloak-services: keycloak-services: saml broker accepts holder-of-key assertions without proof of key possessionCVE-2026-928557.4 High
- red hat build of keycloak 26.4, build of keycloak 26.4.17, build of keycloak 26.6 +2 more +4 moreKeycloak-services: keycloak-services: unauthenticated denial of service via saml soap endpoint unbounded xml parsingCVE-2026-829657.5 High
- red hat build of keycloak 26.4, build of keycloak 26.4.17, build of keycloak 26.6 +2 more +4 moreKeycloak-services: keycloak-services: uma protection api resourcetype field not validated — cross-owner resource accessCVE-2026-1142328.1 High
- red hat build of keycloak 26.6, build of keycloak 26.6.8, single sign-on 7 +2 moreKeycloak-services: keycloak-services: account takeover via stale sso_auth note in organization identity-first loginCVE-2026-1122088.1 High
- red hat build of keycloak 26.6, build of keycloak 26.6.8, single sign-on 7 +2 moreKeycloak-services: keycloak-services: unauthenticated persistent disk exhaustion via theme gzip cacheCVE-2026-1109327.5 High
- red hat build of keycloak 26.4, build of keycloak 26.4.17, build of keycloak 26.6 +2 more +4 moreKeycloak-services: keycloak-services: unauthenticated jvm termination via saml 1.1 authoritybinding parsing loopCVE-2026-1109317.5 High
- red hat build of keycloak 26.4, build of keycloak 26.4.17, build of keycloak 26.6 +2 more +4 moreKeycloak-services: keycloak-services: unauthenticated cpu exhaustion via saml 1.1 keyinfo infinite loopCVE-2026-1076027.5 High
- red hat build of keycloak 26.6, build of keycloak 26.6.8, single sign-on 7 +2 moreKeycloak-services: keycloak-services: unauthenticated cpu denial of service via saml xml datetime and duration parsingCVE-2026-1071237.5 High
- red hat build of keycloak 26.4, build of keycloak 26.4.17, build of keycloak 26.6 +2 more +4 moreKeycloak-services: keycloak-services: account takeover via authentication race using reset-credentials pathCVE-2026-1031127.5 High
- red hat build of keycloak 26.6, build of keycloak 26.6.9, single sign-on 7 +2 moreKeycloak-services: keycloak-services: saml redirect binding signature bypass via percent-encoded parameter namesCVE-2026-117691Public exploit9.1 Critical
- red hat exploit intelligence, openshift serverless, build of apache camel 4 for quarkus 3 +7 more +9 moreIo.quarkus/quarkus-vertx-http: quarkus-vertx-http: authorization bypass in management interface via path concatenation flawCVE-2026-1079127.7 High
- red hat build of apache camel 4 for quarkus 3, build of apicurio registry 3, build of debezium 3 +6 more +8 moreOrg.jboss.resteasy/resteasy-core: resteasy: information disclosure through default exception mapper responsesCVE-2026-1209715.3 Medium
- red hat build of keycloak, single sign-on 7 +1 moreKeycloak-services: keycloak-services: required actions bypassed via kc_action parameterCVE-2026-1189595.4 Medium
- red hat build of keycloak, single sign-on 7 +1 moreKeycloak-services: keycloak-services: authorization bypass via uma resource registration idorCVE-2026-1189474.3 Medium
- red hat build of keycloak, single sign-on 7 +1 moreKeycloak-services: keycloak-services: redirect uri domain allowlist bypass via dns resolution to loopbackCVE-2026-1184256.8 Medium
- red hat build of keycloak, single sign-on 7 +1 moreKeycloak-services: keycloak-services: hotp race condition allows single otp code reuse across concurrent loginsCVE-2026-1180304.2 Medium
- red hat build of keycloak, single sign-on 7 +1 moreKeycloak-services: keycloak-services: par single-use bypass via flow restartCVE-2026-1178595.4 Medium
- red hat build of keycloak, single sign-on 7 +1 moreKeycloak-services: keycloak-services: vault secret disclosure via client registration installation configurationCVE-2026-1176885.3 Medium
- red hat build of keycloak, single sign-on 7 +1 moreKeycloak-services: keycloak-services: jwt authorization grant bypasses identity provider login restrictionsCVE-2026-1176275.4 Medium
- red hat build of keycloak, single sign-on 7 +1 moreKeycloak-services: keycloak-services: required otp enrollment bypassed via update user locale required action orderingCVE-2026-1144384.2 Medium
- red hat build of keycloak, single sign-on 7 +1 moreKeycloak-services: keycloak-services: ciba confidential-only contract not enforced for public clientsCVE-2026-1090826.8 Medium
- red hat build of keycloak 26.6, build of keycloak 26.6.8, single sign-on 7 +2 moreKeycloak-services: keycloak-services: stored xss on login page via kcsanitize bypassCVE-2026-1078895.5 Medium
- red hat build of keycloak 26.6, build of keycloak 26.6.8, single sign-on 7 +2 moreKeycloak-services: keycloak-services: oidc dcr read-modify-write silently disables offline token revocationCVE-2026-1076234.3 Medium
- red hat build of keycloak, single sign-on 7 +1 moreKeycloak-services: keycloak-services: view-clients role allows retrieval of active client secrets via installation provider endpointsCVE-2026-1076044.9 Medium
- red hat build of keycloak 26.6, build of keycloak 26.6.8, single sign-on 7 +2 moreKeycloak-services: keycloak-services: smtp starttls plaintext credential and message downgradeCVE-2026-1071216.5 Medium
- red hat build of keycloak 26.6, build of keycloak 26.6.8, single sign-on 7 +2 moreKeycloak-services: keycloak-services: device authorization grant bypasses per-client minimum.acr.value enforcementCVE-2026-1053055.4 Medium
- red hat build of keycloak, single sign-on 7 +1 moreKeycloak-services: keycloak-services: token introspection audience bypass via dynamic client registrationCVE-2026-105306Public exploit6.5 Medium
- red hat build of keycloak, single sign-on 7 +1 moreKeycloak-services: keycloak-services: user session note mapper exposes upstream idp access tokensCVE-2026-1053025.7 Medium
- red hat build of keycloak 26.6, build of keycloak 26.6.8, single sign-on 7 +2 moreKeycloak-services: keycloak-services: path traversal in x.509 crl distribution point allows arbitrary local file readCVE-2026-1038846.5 Medium
- red hat build of keycloak 26.6.8, single sign-on 7 +1 moreKeycloak-services: keycloak-services: unbounded metric series creation via idp tag on broker login endpointCVE-2026-1013333.7 Low
- Show olderLoading…