Skip to contentRed Hat Keycloak vulnerabilities
- red hat build of keycloak 26.4, build of keycloak 26.4.13, build of keycloak 26.4.14 +8 more +10 moreKeycloak-policy-enforcer: keycloak policy enforcer: authorization bypass via incorrect uri comparisonCVE-2026-9800Fix available8.1 High
- fasterxml jackson-databind, red hat cryostat 4 on rhel 9, openshift developer tools and services +44 more +46 morejackson-databind: Array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray)CVE-2026-54513Fix available8.1 High
- quarkus, red hat cryostat 4 on rhel 9, openshift serverless +15 more +17 moreAuthentication/Authorization Bypass via Advanced Path Normalization VulnerabilitiesCVE-2026-50559Fix available7.5 High
- websockets ws, red hat cluster observability operator 1.5.0, cryostat 4 +46 more +48 morews: Memory exhaustion DoS from tiny fragments and data chunksCVE-2026-48779Fix available7.5 High
- red hat build of keycloak 26.6, build of keycloak 26.6.5, jboss enterprise application platform expansion pack +1 more +3 moreKeycloak-rest-admin-ui-ext: authorization bypass vulnerability in the admin-ui-ext bulk role-mapping-delete endpoints of keycloakCVE-2026-11986Fix available4.9 Medium
- spring micrometer, red hat amq broker 7.13.6, amq broker 7.14.1 +19 more +21 moreMicrometer HTTP server instrumentations DoS vulnerabilityCVE-2026-40984Fix available7.5 High
- spring micrometer, red hat amq broker 7.14.1, amq clients +18 more +20 moreMicrometer gRPC server instrumentation DoS vulnerabilityCVE-2026-40983Fix available7.5 High
- red hat build of keycloak 26.4, build of keycloak 26.4.13, build of keycloak 26.6 +1 more +3 moreKeycloak: keycloak: information disclosure due to user profile permission bypassCVE-2026-9088Fix available2.7 Low
- red hat advanced cluster management for kubernetes 2, build of keycloak, enterprise linux 8 +1 more +3 moredecompress: Arbitrary File Write via Archive Extraction (Zip Slip)CVE-2026-107326.1 Medium
- vitejs launch-editor, vite, red hat cluster observability operator 1.5.0 +25 more +27 morelaunch-editor vulnerable to command injection via the crafted request on WindowsCVE-2024-52011Public exploitFix available7.5 High
- red hat build of keycloak 26.4, build of keycloak 26.4.13, build of keycloak 26.6 +2 more +4 moreKeycloak: keycloak: denial of service via malformed authorization headerCVE-2026-9803Fix available5.3 Medium
- red hat build of keycloak 26.4, build of keycloak 26.4.13, build of keycloak 26.6 +2 more +4 moreKeycloak: keycloak: unauthorized account access via replayed refresh tokens after cluster restartCVE-2026-9802Fix available6.8 Medium
- red hat build of keycloak 26.4, build of keycloak 26.4.13, build of keycloak 26.6 +2 more +4 moreKeycloak: keycloak: denial of service via malformed ldap password policy responseCVE-2026-9801Fix available4.9 Medium
- red hat build of keycloak 26.4, build of keycloak 26.4.14, build of keycloak 26.6 +2 more +4 moreKeycloak: keycloak: brute-force protection bypass in ciba flowCVE-2026-97984.3 Medium
- red hat build of keycloak, build of keycloak 26.6, build of keycloak 26.6.6 +2 moreKeycloak: keycloak: privilege escalation via time-of-check to time-of-use (toctou) vulnerabilityCVE-2026-9796Fix available6.5 Medium
- red hat build of keycloak 26.4, build of keycloak 26.4.13, build of keycloak 26.6 +2 more +4 moreKeycloak: keycloak: privilege escalation via improper scope mapping enforcementCVE-2026-9795Fix available7.3 High
- red hat build of keycloak 26.4, build of keycloak 26.4.13, build of keycloak 26.6 +2 more +4 moreKeycloak: keycloak: information disclosure via saml ecp endpointCVE-2026-9794Public exploitFix available5.3 Medium
- red hat build of keycloak 26.4, build of keycloak 26.4.13, build of keycloak 26.6 +2 more +4 moreKeycloak: keycloak: security restriction bypass allows unauthorized ropc token acquisitionCVE-2026-9792Fix available6.5 Medium
- red hat build of keycloak 26.4, build of keycloak 26.4.14, build of keycloak 26.6 +2 more +4 moreKeycloak: keycloak: security policy bypass in jwe-encrypted request object processingCVE-2026-97935.9 Medium
- red hat build of keycloak 26.4, build of keycloak 26.4.13, build of keycloak 26.6 +2 more +4 moreKeycloak-rhel9: organization data leak after feature disabled in keycloakCVE-2026-9791Fix available4.3 Medium
- red hat build of keycloak 26.4, build of keycloak 26.4.13, build of keycloak 26.6 +2 more +4 moreKeycloak: keycloak: privilege escalation due to oversized subject_token jwtCVE-2026-9704Fix available6.8 Medium
- red hat build of keycloak 26.4, build of keycloak 26.4.14, build of keycloak 26.6 +2 more +4 moreKeycloak: org.keycloak.protocol.oidc: http parameter pollution in oidc redirect uri allows response parameter duplication - #ghi-604CVE-2026-96894.2 Medium
- red hat build of keycloak 26.4, build of keycloak 26.4.13, build of keycloak 26.6 +2 more +4 moreKeycloak: cross-session email verification proof not bound to upstream identity in first-broker-loginCVE-2026-9087Fix available6.4 Medium
- red hat build of keycloak 26.4, build of keycloak 26.4.12, redhat build of keycloak +2 moreKeycloak: keycloak: access token disclosure and implicit flow bypass via forged client dataCVE-2026-7571Fix available7.1 High
- red hat build of keycloak 26.2, build of keycloak 26.2.16, build of keycloak 26.4 +7 more +9 moreOrg.keycloak/keycloak-services: session fixation in oidc login flow that can lead to account takeoverCVE-2026-7507Fix available7.5 High
- red hat build of keycloak 26.2, build of keycloak 26.2.16, build of keycloak 26.4 +2 more +4 moreOrg.keycloak/keycloak-services: open redirect when using wildcard valid redirect uris in keycloakCVE-2026-7504Fix available8.1 High
- red hat build of keycloak 26.4, build of keycloak 26.4.12, redhat build of keycloak +2 moreKeycloak: org.keycloak.authentication: keycloak: unauthorized account takeover via webauthn token replayCVE-2026-37982Fix available6.8 Medium
- red hat build of keycloak 26.4, build of keycloak 26.4.12, redhat build of keycloak +2 moreKeycloak: keycloak: information disclosure via oidc token introspection endpoint audience bypassCVE-2026-37979Fix available6.5 Medium
- red hat build of keycloak 26.4, build of keycloak 26.4.12, redhat build of keycloak +2 moreKeycloak: org.keycloak.services: keycloak: information disclosure via evaluate-scopes admin apiCVE-2026-37978Fix available4.9 Medium
- red hat build of keycloak 26.2, build of keycloak 26.2.16, build of keycloak 26.4 +7 more +9 moreKeycloak: keycloak: denial of service via specially crafted saml inputCVE-2026-7307Fix available7.5 High
- red hat build of keycloak 26.4, build of keycloak 26.4.12, redhat build of keycloak +2 moreKeycloak: org.keycloak.authorization: keycloak: information disclosure via broken access control in user lookup endpointCVE-2026-37981Fix available4.3 Medium
- red hat build of keycloak 26.4, build of keycloak 26.4.12, redhat build of keycloak +2 moreKeycloak: keycloak: unauthorized resource access and data modification via insecure direct object referenceCVE-2026-4630Fix available6.8 Medium
- red hat build of keycloak 26.4, build of keycloak 26.4.13, build of keycloak 26.6 +2 more +4 moreOrg.keycloak/keycloak-services: keycloak: org.keycloak.protocol.oidc: security flaw in org.keycloak/keycloak-servicesCVE-2026-89225.4 Medium
- red hat build of keycloak 26.4, build of keycloak 26.4.13, build of keycloak 26.6 +2 more +4 moreKeycloak: org.keycloak/keycloak-services: keycloak: policy bypass during webauthn credential registration via client-side javascript manipulationCVE-2026-8830Fix available4.3 Medium
- quarkus, red hat cryostat 4 on rhel 9, hawtio hawtio 4.4.0 +16 more +18 moreQuarkus authorization bypass via semicolon path normalization inconsistencyCVE-2026-39852Fix available8.8 High
- websockets ws, red hat cryostat 4, cryostat 4 on rhel 9 +47 more +49 morews: Uninitialized memory disclosureCVE-2026-45736Fix available4.4 Medium
- red hat build of keycloak 26.4, build of keycloak 26.4.13, build of keycloak 26.6 +2 more +4 moreOrg.keycloak.keycloak-services: improper access control on keycloak server when the account account api feature is disabledCVE-2026-75005.4 Medium
- legion of the bouncy castle inc. bc-java, red hat cryostat 4, openshift developer tools and services +29 more +31 moreNon-constant time comparisons risk private key leakage in FrodoKEM.CVE-2026-5598Fix available8.9 High
- legion of the bouncy castle inc. bc-java, red hat cryostat 4, openshift developer tools and services +44 more +46 moreGOSTCTR implementation unable to process more than 255 blocks correctlyCVE-2025-14813Fix available9.3 Critical
- red hat build of keycloak, build of keycloak 26.4.12 +1 moreOrg.keycloak.forms.login: keycloak: keycloak: arbitrary code execution via stored cross-site scripting (xss) in organization selection login pageCVE-2026-379806.9 Medium
- simple-git project simple-git, red hat build of keycloak, enterprise linux 8 +5 more +7 moresimple-git has Command Execution via Option-Parsing BypassCVE-2026-28291Fix available8.1 High
- vitejs vite, red hat advanced cluster security 4, ansible automation platform 2 +9 more +11 moreVite has a `server.fs.deny` bypass with queriesCVE-2026-393648.2 High
- vitejs vite, red hat advanced cluster security 4, ansible automation platform 2 +13 more +15 moreVite Affected by Arbitrary File Read via Vite Dev Server WebSocketCVE-2026-39363Public exploitFix available8.2 High
- red hat build of keycloak 26.4, build of keycloak 26.4.13, build of keycloak 26.6 +2 more +4 moreKeycloak: org.keycloak.protocol.oidc.grants.ciba: keycloak: information disclosure via cors header injection due to unvalidated jwt azp claimCVE-2026-37977Fix available3.7 Low
- red hat build of keycloak 26.2, build of keycloak 26.2.15, build of keycloak 26.4 +2 more +4 moreKeycloak: keycloak: uma policy bypass allows authenticated users to gain unauthorized access to victim-owned resources.CVE-2026-4636Fix available8.1 High
- red hat build of keycloak 26.2, build of keycloak 26.2.15, build of keycloak 26.4 +7 more +9 moreKeycloak: keycloak: denial of service via excessive processing of openid connect scope parametersCVE-2026-4634Fix available7.5 High
- red hat build of keycloak 26.2, build of keycloak 26.2.15, build of keycloak 26.4 +2 more +4 moreKeycloak: keycloak: replay of action tokens via improper handling of single-use entriesCVE-2026-4325Fix available5.3 Medium
- red hat build of keycloak 26.2, build of keycloak 26.2.15, build of keycloak 26.4 +2 more +4 moreKeycloak: keycloak: privilege escalation via forged authorization codes due to singleuseobjectprovider isolation flawCVE-2026-4282Public exploitFix available7.4 High
- red hat build of keycloak 26.2, build of keycloak 26.2.15, build of keycloak 26.4 +2 more +4 moreKeycloak: keycloak: information disclosure due to redirect_uri validation bypassCVE-2026-3872Fix available7.3 High
- lodash, lodash lodash-amd, lodash-es +105 more +107 morelodash vulnerable to Code Injection via `_.template` imports key namesCVE-2026-4800Public exploitFix available8.1 High
- Show moreLoading…