Skip to contentRed Hat Build Of Keycloak 26 vulnerabilities
- red hat build of keycloak 26.4, build of keycloak 26.4.17, build of keycloak 26.6 +2 more +4 moreKeycloak-services: keycloak-services: protocol mapper with jsontype=json bypasses token sanitizationCVE-2026-978486.5 Medium
- red hat build of keycloak 26.4, build of keycloak 26.4.17, build of keycloak 26.6 +2 more +4 moreKeycloak-services: keycloak-services: dcr azp and sid claim substitution allows account rest session takeoverCVE-2026-973676.4 Medium
- red hat build of keycloak 26.4, build of keycloak 26.4.17, build of keycloak 26.6 +2 more +4 moreKeycloak-services: keycloak-services: dcr registration-time claim-path gap allows forging realm_access.rolesCVE-2026-965476.5 Medium
- red hat build of keycloak 26.6, build of keycloak 26.6.8, single sign-on 7 +2 moreKeycloak-services: keycloak-services: indefinite access token renewal via standard token exchange v2CVE-2026-964605.4 Medium
- red hat build of keycloak 26.6, build of keycloak 26.6.8, single sign-on 7 +2 moreKeycloak-services: keycloak-services: saml broker ignores proxyrestriction delegation constraintsCVE-2026-928564.9 Medium
- red hat build of keycloak 26.6, build of keycloak 26.6.8, single sign-on 7 +2 moreKeycloak-services: keycloak-services: admin api missing audience checkCVE-2026-196886.8 Medium
- red hat build of keycloak 26.6, build of keycloak 26.6.8, single sign-on 7 +2 moreKeycloak-services: keycloak-services: stateless token preferred_username fallback enables identity rebindingCVE-2026-964474.2 Medium
- red hat build of keycloak 26.6, build of keycloak 26.6.8, single sign-on 7 +2 moreKeycloak-services: keycloak-services: injection of roles into realm default-roles via dcr endpointCVE-2026-1090816.8 Medium
- red hat build of keycloak 26.6, build of keycloak 26.6.8, single sign-on 7 +2 moreKeycloak-services: keycloak-services: oidc logout endpoint session fixation via id_token_hint leading to account takeoverCVE-2026-1071246.4 Medium
- red hat build of keycloak 26.4, build of keycloak 26.4.17, build of keycloak 26.6 +2 more +4 moreKeycloak-services: keycloak-services: client manager can substitute sessionless token principal via hardcoded-claim mappers to obtain realm administrator authorityCVE-2026-978477.1 High
- red hat build of keycloak 26.4.17, build of keycloak 26.6.8, single sign-on 7 +2 moreKeycloak-services: keycloak-services: unverified idp email auto-linking enables account takeoverCVE-2026-971758.8 High
- red hat build of keycloak 26.6, build of keycloak 26.6.8, single sign-on 7 +2 moreKeycloak-services: keycloak-services: ciba sub parameter injection causes attacker authentication to issue victim tokensCVE-2026-971746.8 Medium
- red hat amq broker 7, build of keycloak 26.4, build of keycloak 26.4.17 +8 more +10 moreOrg.keycloak/keycloak-admin-cli: keycloak-admin-cli: kcadm custom truststore accepts arbitrary self-signed certificatesCVE-2026-964538.0 High
- red hat amq broker 7, build of keycloak 26.4, build of keycloak 26.4.17 +8 more +10 moreKeycloak-core: keycloak-core: saml adapter does not bind signed assertions to the configured identity provider issuerCVE-2026-939987.4 High
- red hat build of keycloak 26.4, build of keycloak 26.4.17, build of keycloak 26.6 +2 more +4 moreKeycloak-services: keycloak-services: dcr protocol mapper config not validated, allowing iat holders to forge sub and aud claims in signed tokensCVE-2026-928578.1 High
- red hat build of keycloak 26.4, build of keycloak 26.4.17, build of keycloak 26.6 +2 more +4 moreKeycloak-services: keycloak-services: saml broker accepts holder-of-key assertions without proof of key possessionCVE-2026-928557.4 High
- red hat build of keycloak 26.4, build of keycloak 26.4.17, build of keycloak 26.6 +2 more +4 moreKeycloak-services: keycloak-services: unauthenticated denial of service via saml soap endpoint unbounded xml parsingCVE-2026-829657.5 High
- red hat build of keycloak 26.4, build of keycloak 26.4.17, build of keycloak 26.6 +2 more +4 moreKeycloak-services: keycloak-services: uma protection api resourcetype field not validated — cross-owner resource accessCVE-2026-1142328.1 High
- red hat build of keycloak 26.6, build of keycloak 26.6.8, single sign-on 7 +2 moreKeycloak-services: keycloak-services: account takeover via stale sso_auth note in organization identity-first loginCVE-2026-1122088.1 High
- red hat build of keycloak 26.6, build of keycloak 26.6.8, single sign-on 7 +2 moreKeycloak-services: keycloak-services: unauthenticated persistent disk exhaustion via theme gzip cacheCVE-2026-1109327.5 High
- red hat build of keycloak 26.4, build of keycloak 26.4.17, build of keycloak 26.6 +2 more +4 moreKeycloak-services: keycloak-services: unauthenticated jvm termination via saml 1.1 authoritybinding parsing loopCVE-2026-1109317.5 High
- red hat build of keycloak 26.4, build of keycloak 26.4.17, build of keycloak 26.6 +2 more +4 moreKeycloak-services: keycloak-services: unauthenticated cpu exhaustion via saml 1.1 keyinfo infinite loopCVE-2026-1076027.5 High
- red hat build of keycloak 26.6, build of keycloak 26.6.8, single sign-on 7 +2 moreKeycloak-services: keycloak-services: unauthenticated cpu denial of service via saml xml datetime and duration parsingCVE-2026-1071237.5 High
- red hat build of keycloak 26.4, build of keycloak 26.4.17, build of keycloak 26.6 +2 more +4 moreKeycloak-services: keycloak-services: account takeover via authentication race using reset-credentials pathCVE-2026-1031127.5 High
- red hat build of keycloak 26.6, build of keycloak 26.6.9, single sign-on 7 +2 moreKeycloak-services: keycloak-services: saml redirect binding signature bypass via percent-encoded parameter namesCVE-2026-117691Public exploit9.1 Critical
- red hat build of keycloak 26.6, build of keycloak 26.6.8, single sign-on 7 +2 moreKeycloak-services: keycloak-services: stored xss on login page via kcsanitize bypassCVE-2026-1078895.5 Medium
- red hat build of keycloak 26.6, build of keycloak 26.6.8, single sign-on 7 +2 moreKeycloak-services: keycloak-services: oidc dcr read-modify-write silently disables offline token revocationCVE-2026-1076234.3 Medium
- red hat build of keycloak 26.6, build of keycloak 26.6.8, single sign-on 7 +2 moreKeycloak-services: keycloak-services: smtp starttls plaintext credential and message downgradeCVE-2026-1071216.5 Medium
- red hat build of keycloak 26.6, build of keycloak 26.6.8, single sign-on 7 +2 moreKeycloak-services: keycloak-services: device authorization grant bypasses per-client minimum.acr.value enforcementCVE-2026-1053055.4 Medium
- red hat build of keycloak 26.6, build of keycloak 26.6.8, single sign-on 7 +2 moreKeycloak-services: keycloak-services: path traversal in x.509 crl distribution point allows arbitrary local file readCVE-2026-1038846.5 Medium
- red hat build of keycloak 26.6.8, single sign-on 7 +1 moreKeycloak-services: keycloak-services: unbounded metric series creation via idp tag on broker login endpointCVE-2026-1013333.7 Low
- red hat build of keycloak 26.6.8, single sign-on 7 +1 moreKeycloak-services: keycloak-services: fgap v2 composite-blind role mapping allows privilege escalationCVE-2026-964486.6 Medium
- red hat build of keycloak 26.6.8, single sign-on 7 +1 moreKeycloak-services: keycloak-services: standard token exchange v2 bypasses mtls holder-of-key bindingCVE-2026-978466.8 Medium
- red hat build of keycloak 26.6.8, single sign-on 7 +1 moreKeycloak-services: keycloak-services: admin rest api role-groups endpoint discloses groups without authorizationCVE-2026-973114.3 Medium
- red hat build of keycloak 26.6.8, single sign-on 7 +1 moreKeycloak-services: keycloak-services: generic user update bypasses denied reset-password permissionCVE-2026-971776.6 Medium
- red hat build of keycloak 26.6.8, single sign-on 7 +1 moreKeycloak-services: keycloak-services: conditional otp skip-header policy evaluated against untrusted proxy headersCVE-2026-964456.8 Medium
- red hat build of keycloak 26.6.8, single sign-on 7 +1 moreKeycloak-services: keycloak-services: par single-use bypass via prompt=none silent authentication pathCVE-2026-964464.2 Medium
- red hat build of keycloak 26.6.8, single sign-on 7 +1 moreKeycloak-services: keycloak-services: potential kdc spoofing bypass when kerberos password authentication is enabledCVE-2026-955036.8 Medium
- red hat build of keycloak 26.6.8, single sign-on 7 +1 moreKeycloak-services: keycloak-services: 2fa setup enforcement bypass via authentication session restart endpointCVE-2026-942183.1 Low
- red hat build of keycloak 26.6.8, single sign-on 7 +1 moreKeycloak-services: keycloak-services: uma scope merge across resource owners via resource name collisionCVE-2026-942173.5 Low
- red hat build of keycloak 26.6.8, single sign-on 7 +1 moreKeycloak-services: keycloak-services: cross-realm client read/write via request-level cache missing realm ownership checkCVE-2026-942155.5 Medium
- red hat build of keycloak 26.6.8, single sign-on 7 +1 moreKeycloak-services: keycloak-services: authorization services policy evaluation endpoint leaks user identityCVE-2026-942134.9 Medium
- red hat build of keycloak 26.6, build of keycloak 26.6.8, single sign-on 7 +2 moreKeycloak-services: keycloak-services: admin credential delete bypasses denied reset-password permissionCVE-2026-940016.5 Medium
- red hat build of keycloak 26.6, build of keycloak 26.6.8, single sign-on 7 +2 moreKeycloak-services: keycloak-services: delegated admin with manage-users can escalate to realm-admin via group membershipCVE-2026-94000Public exploit6.6 Medium
- red hat build of keycloak 26.6, build of keycloak 26.6.8, single sign-on 7 +2 moreKeycloak-services: keycloak-services: token refresh continues issuing tokens for disabled audience clientsCVE-2026-939994.2 Medium
- red hat amq broker 7, amq clients, build of apache camel 4 for quarkus 3 +14 more +16 moreIo.netty/netty-codec-http: netty: incomplete validation of malformed transfer-encoding allows http request smugglingCVE-2026-935626.5 Medium
- red hat amq broker 7, amq clients, build of apache camel 4 for quarkus 3 +14 more +16 moreIo.netty/netty-codec-http: netty: http request smuggling via post-digit whitespace in chunk-size parsingCVE-2026-935746.5 Medium
- red hat amq broker 7, build of apache camel 4 for quarkus 3, build of apache camel for spring boot 4 +15 more +17 moreIo.netty/netty-codec-http2: netty: http/2 header field values are not validated by default (cr/lf/nul passthrough)CVE-2026-935796.5 Medium
- red hat amq broker 7, amq clients, build of apache camel 4 for quarkus 3 +14 more +16 moreIo.netty/netty-codec-http: netty split transfer-encoding fields bypass final-chunked validation and enable request smugglingCVE-2026-935736.5 Medium
- red hat amq broker 7, build of apache camel 3.33.3.sp2, build of apache camel 4 for quarkus 3 +16 more +18 moreIo.netty/netty-codec-http2: io.netty/netty-codec-http3: netty: http/2 and http/3 extended connect requests are downgraded as regular connect requestsCVE-2026-935687.5 High
- Show moreLoading…