Skip to contentRed Hat Build Of Keycloak 26.4.9 vulnerabilities
- redhat keycloak, red hat build of keycloak 26.4, build of keycloak 26.4.9 +4 more +6 moreOrg.keycloak/keycloak-services: keycloak: unauthorized modification of unmanaged user attributes by administratorsCVE-2026-0871Fix available4.9 Medium
- red hat build of keycloak 26.2, build of keycloak 26.2.13, build of keycloak 26.4 +1 more +3 moreKeycloak: incorrect ownership checks in /uma-policy/CVE-2025-14778Fix available5.4 Medium
- red hat build of keycloak 26.2, build of keycloak 26.2.13, build of keycloak 26.4 +1 more +3 moreOrg.keycloak.services.resources.organizations: keycloak: unauthorized organization registration via improper invitation token validationCVE-2026-1529Public exploitFix available8.1 High
- red hat build of keycloak 26.4, build of keycloak 26.4.9 +1 moreOrg.keycloak.protocol.oidc.grants: disabled identity providers are still accepted for jwt authorization grantCVE-2026-1486Fix available8.8 High
- red hat build of keycloak 26.4, build of keycloak 26.4.9 +1 moreOrg.keycloak.services.resources.admin: keycloak: limited administrator can retrieve sensitive user attributes via admin apiCVE-2025-13881Fix available2.7 Low
- red hat build of keycloak 26.4, build of keycloak 26.4.9 +1 moreOrg.keycloak/keycloak-services: keycloak keycloak-services: business logic flaw allows unauthorized token issuance for disabled usersCVE-2025-14559Fix available6.5 Medium
- red hat build of keycloak, build of keycloak 26.4.9, jboss enterprise application platform 8 +1 more +3 moreOrg.keycloak/keycloak-quarkus-server: keycloak: proxy bypass due to improper handling of matrix parameters in url pathsCVE-2026-09763.7 Low