Skip to contentRed Hat Build Of Keycloak 26.4.12 vulnerabilities
- red hat build of keycloak 26.4, build of keycloak 26.4.12, redhat build of keycloak +2 moreKeycloak: keycloak: access token disclosure and implicit flow bypass via forged client dataCVE-2026-7571Fix available7.1 High
- red hat build of keycloak 26.2, build of keycloak 26.2.16, build of keycloak 26.4 +7 more +9 moreOrg.keycloak/keycloak-services: session fixation in oidc login flow that can lead to account takeoverCVE-2026-7507Fix available7.5 High
- red hat build of keycloak 26.2, build of keycloak 26.2.16, build of keycloak 26.4 +2 more +4 moreOrg.keycloak/keycloak-services: open redirect when using wildcard valid redirect uris in keycloakCVE-2026-7504Fix available8.1 High
- red hat build of keycloak 26.4, build of keycloak 26.4.12, redhat build of keycloak +2 moreKeycloak: org.keycloak.authentication: keycloak: unauthorized account takeover via webauthn token replayCVE-2026-37982Fix available6.8 Medium
- red hat build of keycloak 26.4, build of keycloak 26.4.12, redhat build of keycloak +2 moreKeycloak: keycloak: information disclosure via oidc token introspection endpoint audience bypassCVE-2026-37979Fix available6.5 Medium
- red hat build of keycloak 26.4, build of keycloak 26.4.12, redhat build of keycloak +2 moreKeycloak: org.keycloak.services: keycloak: information disclosure via evaluate-scopes admin apiCVE-2026-37978Fix available4.9 Medium
- red hat build of keycloak 26.2, build of keycloak 26.2.16, build of keycloak 26.4 +7 more +9 moreKeycloak: keycloak: denial of service via specially crafted saml inputCVE-2026-7307Fix available7.5 High
- red hat build of keycloak 26.4, build of keycloak 26.4.12, redhat build of keycloak +2 moreKeycloak: org.keycloak.authorization: keycloak: information disclosure via broken access control in user lookup endpointCVE-2026-37981Fix available4.3 Medium
- red hat build of keycloak 26.4, build of keycloak 26.4.12, redhat build of keycloak +2 moreKeycloak: keycloak: unauthorized resource access and data modification via insecure direct object referenceCVE-2026-4630Fix available6.8 Medium
- red hat build of keycloak, build of keycloak 26.4.12 +1 moreOrg.keycloak.forms.login: keycloak: keycloak: arbitrary code execution via stored cross-site scripting (xss) in organization selection login pageCVE-2026-379806.9 Medium
- red hat build of keycloak, build of keycloak 26.4.12 +1 moreKeycloak: keycloak: user enumeration via differential error messagesCVE-2026-4633Fix available3.7 Low
- red hat build of keycloak, build of keycloak 26.4.12, jboss enterprise application platform 8 +2 more +4 moreKeycloak: org.keycloak.authorization: keycloak: unauthorized resource modification due to improper access controlCVE-2026-46284.3 Medium
- red hat build of keycloak, build of keycloak 26.4, build of keycloak 26.4.12 +5 more +7 moreKeycloak-services: blind server-side request forgery (ssrf) via http redirect handling in keycloakCVE-2026-43665.8 Medium