Skip to contentRed Hat Build Of Keycloak 26.2 vulnerabilities
- red hat build of keycloak 26.2, build of keycloak 26.2.16, build of keycloak 26.4 +7 more +9 moreOrg.keycloak/keycloak-services: session fixation in oidc login flow that can lead to account takeoverCVE-2026-7507Fix available7.5 High
- red hat build of keycloak 26.2, build of keycloak 26.2.16, build of keycloak 26.4 +2 more +4 moreOrg.keycloak/keycloak-services: open redirect when using wildcard valid redirect uris in keycloakCVE-2026-7504Fix available8.1 High
- red hat build of keycloak 26.2, build of keycloak 26.2.16, build of keycloak 26.4 +7 more +9 moreKeycloak: keycloak: denial of service via specially crafted saml inputCVE-2026-7307Fix available7.5 High
- red hat build of keycloak 26.2, build of keycloak 26.2.15, build of keycloak 26.4 +2 more +4 moreKeycloak: keycloak: uma policy bypass allows authenticated users to gain unauthorized access to victim-owned resources.CVE-2026-4636Fix available8.1 High
- red hat build of keycloak 26.2, build of keycloak 26.2.15, build of keycloak 26.4 +7 more +9 moreKeycloak: keycloak: denial of service via excessive processing of openid connect scope parametersCVE-2026-4634Fix available7.5 High
- red hat build of keycloak 26.2, build of keycloak 26.2.15, build of keycloak 26.4 +2 more +4 moreKeycloak: keycloak: replay of action tokens via improper handling of single-use entriesCVE-2026-4325Fix available5.3 Medium
- red hat build of keycloak 26.2, build of keycloak 26.2.15, build of keycloak 26.4 +2 more +4 moreKeycloak: keycloak: privilege escalation via forged authorization codes due to singleuseobjectprovider isolation flawCVE-2026-4282Public exploitFix available7.4 High
- red hat build of keycloak 26.2, build of keycloak 26.2.15, build of keycloak 26.4 +2 more +4 moreKeycloak: keycloak: information disclosure due to redirect_uri validation bypassCVE-2026-3872Fix available7.3 High
- red hat build of keycloak 26.2, build of keycloak 26.2.14, build of keycloak 26.4 +2 more +4 moreKeycloak: keycloak: unauthorized authentication via disabled saml identity providerCVE-2026-2603Fix available8.1 High
- red hat build of keycloak 26.2, build of keycloak 26.2.14, build of keycloak 26.4 +7 more +9 moreKeycloak-services: keycloak: unauthorized access via improper validation of encrypted saml assertionsCVE-2026-2092Fix available7.7 High
- redhat keycloak, red hat build of keycloak 26.2, build of keycloak 26.2.14 +3 more +5 moreOrg.keycloak.broker.saml: keycloak saml broker: authentication bypass due to disabled saml client completing idp-initiated loginCVE-2026-3047Fix available8.8 High
- keycloak, red hat build of keycloak 26.2, build of keycloak 26.2.11 +3 more +5 moreOrg.keycloak/keycloak-services: webauthn attestation statement verification bypassCVE-2025-12150Fix available3.1 Low
- red hat build of keycloak 26.2, build of keycloak 26.2.13, build of keycloak 26.4 +1 more +3 moreKeycloak: incorrect ownership checks in /uma-policy/CVE-2025-14778Fix available5.4 Medium
- red hat build of keycloak 26.2, build of keycloak 26.2.13, build of keycloak 26.4 +1 more +3 moreOrg.keycloak.services.resources.organizations: keycloak: unauthorized organization registration via improper invitation token validationCVE-2026-1529Public exploitFix available8.1 High
- keycloak, red hat build of keycloak 26.2, build of keycloak 26.2.11 +2 more +4 moreOrg.keycloak.storage.ldap: keycloak: deserialization of untrusted data in ldap user federationCVE-2025-13467Fix available5.5 Medium
- keycloak, red hat build of keycloak 26.2, build of keycloak 26.2.11 +2 more +4 moreOrg.keycloak.protocol.oidc.endpoints.logoutendpoint: offline session takeover due to reused authentication session idCVE-2025-12390Fix available6.0 Medium
- red hat build of keycloak 26.0, build of keycloak 26.0.16, build of keycloak 26.2 +1 more +3 moreKeycloak: keycloak tls client-initiated renegotiation denial of serviceCVE-2025-11419Fix available7.5 High
- keycloak, red hat build of keycloak 26.2, build of keycloak 26.2.11 +2 more +4 moreKeycloak: org.keycloak:keycloak-services: user can refresh offline session even after client's offline_access scope was removedCVE-2025-12110Fix available5.4 Medium
- keycloak, red hat build of keycloak 26.2, build of keycloak 26.2.11 +2 moreKeycloak-server: too long and not settings compliant sessionCVE-2025-11429Fix available5.4 Medium
- keycloak, red hat build of keycloak 26.0, build of keycloak 26.0.17 +2 more +4 moreKeycloak: keycloak error_description injection on error pagesCVE-2025-10044Fix available4.3 Medium
- keycloak, red hat build of keycloak 26.0, build of keycloak 26.2 +1 more +3 moreOrg.keycloak/keycloak-model-storage-service: variable injection into environment variablesCVE-2025-9162Fix available4.9 Medium
- keycloak, red hat build of keycloak, build of keycloak 26.0 +1 more +3 moreOrg.keycloak/keycloak-services: keycloak smtp inject vulnerabilityCVE-2025-8419Fix available5.3 Medium
- red hat build of keycloak 26, build of keycloak 26.2, jboss enterprise application platform 8 +3 more +5 moreOrg.keycloak/keycloak-services: privilege escalation in keycloak admin console (fgapv2 enabled)CVE-2025-7784Fix available6.5 Medium
- redhat keycloak, red hat build of keycloak 26, build of keycloak 26.0 +1 more +3 moreKeycloak: phishing attack via email verification step in first login flowCVE-2025-7365Fix available7.1 High
- red hat build of keycloak, build of keycloak 26, build of keycloak 26.0 +2 more +4 moreOrg.keycloak.protocol.services: keycloak hostname verificationCVE-2025-3501Fix available8.2 High
- red hat cryostat 3, cryostat 4 on rhel 9, hawtio hawtio 4.2.0 +12 more +14 moreIo.quarkus.http/quarkus-http-core: quarkus http cookie smugglingCVE-2024-12397Fix available7.4 High