Skip to contentRed Hat Build Of Keycloak 26.4.11 vulnerabilities
- red hat build of keycloak 26.2, build of keycloak 26.2.15, build of keycloak 26.4 +2 more +4 moreKeycloak: keycloak: uma policy bypass allows authenticated users to gain unauthorized access to victim-owned resources.CVE-2026-4636Fix available8.1 High
- red hat build of keycloak 26.2, build of keycloak 26.2.15, build of keycloak 26.4 +7 more +9 moreKeycloak: keycloak: denial of service via excessive processing of openid connect scope parametersCVE-2026-4634Fix available7.5 High
- red hat build of keycloak 26.2, build of keycloak 26.2.15, build of keycloak 26.4 +2 more +4 moreKeycloak: keycloak: replay of action tokens via improper handling of single-use entriesCVE-2026-4325Fix available5.3 Medium
- red hat build of keycloak 26.2, build of keycloak 26.2.15, build of keycloak 26.4 +2 more +4 moreKeycloak: keycloak: privilege escalation via forged authorization codes due to singleuseobjectprovider isolation flawCVE-2026-4282Public exploitFix available7.4 High
- red hat build of keycloak 26.2, build of keycloak 26.2.15, build of keycloak 26.4 +2 more +4 moreKeycloak: keycloak: information disclosure due to redirect_uri validation bypassCVE-2026-3872Fix available7.3 High
- red hat build of keycloak 26.4, build of keycloak 26.4.11, jboss enterprise application platform 8 +5 more +7 moreKeycloak: org.keycloak/keycloak-services: keycloak: privilege escalation via manage-clients permissionCVE-2026-3121Fix available6.5 Medium
- red hat build of keycloak 26.4, build of keycloak 26.4.11, redhat build of keycloak +2 moreKeycloak: keycloak: information disclosure via improper role enforcement in uma 2.0 protection apiCVE-2026-3190Fix available4.3 Medium
- red hat build of keycloak 26.4, build of keycloak 26.4.11, redhat build of keycloak +2 moreKeycloak: keycloak: information disclosure via authorization bypass in admin apiCVE-2026-2366Fix available3.1 Low
- red hat build of keycloak, build of keycloak 26.4, build of keycloak 26.4.11 +3 more +5 moreOrg.keycloak.services.resources.account: improper access control leading to mfa deletion and account takeover in keycloak account rest apiCVE-2026-3429Fix available4.2 Medium
- red hat build of keycloak 26.4, build of keycloak 26.4.11, redhat build of keycloak +2 moreOrg.keycloak.services.resources.admin.userresource: keycloak: information disclosure of disabled user attributes via administrative endpointCVE-2026-3911Fix available2.7 Low
- red hat build of keycloak 26.4, build of keycloak 26.4.11 +1 moreKeycloak-server: keycloak: improper access control in admin rest api leads to information disclosureCVE-2025-140832.7 Low
- red hat build of keycloak 26.4, build of keycloak 26.4.11, jboss enterprise application platform 8 +2 more +4 moreOrg.keycloak.protocol.oidc: keycloak refresh token reuse bypass via toctou race conditionCVE-2026-10353.1 Low
- red hat build of keycloak, build of keycloak 26.4, build of keycloak 26.4.11 +3 more +5 moreOrg.keycloak.protocol.oidc: blind server-side request forgery (ssrf) in keycloak oidc dynamic client registration via jwks_uriCVE-2026-11805.8 Medium
- red hat build of keycloak 26.4, build of keycloak 26.4.11 +1 moreKeycloak: keycloak idor in realm client creating/deletingCVE-2025-147776.0 Medium
- red hat build of keycloak 26.4, build of keycloak 26.4.11 +1 moreKeycloak-services: keycloak admin rest api: improper access control leads to sensitive role metadata information disclosureCVE-2025-14082Fix available2.7 Low