Skip to contentRed Hat Build Of Keycloak 26.4 vulnerabilities
- keycloak, red hat build of keycloak 26.2, build of keycloak 26.2.11 +3 more +5 moreOrg.keycloak/keycloak-services: webauthn attestation statement verification bypassCVE-2025-12150Fix available3.1 Low
- redhat keycloak, red hat build of keycloak 26.4, build of keycloak 26.4.9 +4 more +6 moreOrg.keycloak/keycloak-services: keycloak: unauthorized modification of unmanaged user attributes by administratorsCVE-2026-0871Fix available4.9 Medium
- red hat build of keycloak, build of keycloak 26.4, build of keycloak 26.4.10 +3 more +5 moreOrg.keycloak/keycloak-services: keycloak: missing check on disabled client for docker registry protocolCVE-2026-27333.8 Low
- red hat build of keycloak, build of keycloak 26.4.2 +1 moreKeycloak-services: sensitive headers shown in the http access logsCVE-2025-11537Fix available5.0 Medium
- red hat build of keycloak 26.2, build of keycloak 26.2.13, build of keycloak 26.4 +1 more +3 moreKeycloak: incorrect ownership checks in /uma-policy/CVE-2025-14778Fix available5.4 Medium
- red hat build of keycloak 26.2, build of keycloak 26.2.13, build of keycloak 26.4 +1 more +3 moreOrg.keycloak.services.resources.organizations: keycloak: unauthorized organization registration via improper invitation token validationCVE-2026-1529Public exploitFix available8.1 High
- red hat build of keycloak 26.4, build of keycloak 26.4.9 +1 moreOrg.keycloak.protocol.oidc.grants: disabled identity providers are still accepted for jwt authorization grantCVE-2026-1486Fix available8.8 High
- red hat build of keycloak 26.4, build of keycloak 26.4.9 +1 moreOrg.keycloak.services.resources.admin: keycloak: limited administrator can retrieve sensitive user attributes via admin apiCVE-2025-13881Fix available2.7 Low
- red hat build of keycloak 26.4, build of keycloak 26.4.10, jboss enterprise application platform 8 +2 more +4 moreOrg.keycloak/keycloak-services: keycloak saml brokering: response delay due to unchecked notonorafter in subjectconfirmationdataCVE-2026-11903.1 Low
- red hat build of keycloak 26.4, build of keycloak 26.4.11 +1 moreKeycloak-server: keycloak: improper access control in admin rest api leads to information disclosureCVE-2025-140832.7 Low
- red hat build of keycloak 26.4, build of keycloak 26.4.9 +1 moreOrg.keycloak/keycloak-services: keycloak keycloak-services: business logic flaw allows unauthorized token issuance for disabled usersCVE-2025-14559Fix available6.5 Medium
- red hat build of keycloak 26.4, build of keycloak 26.4.11, jboss enterprise application platform 8 +2 more +4 moreOrg.keycloak.protocol.oidc: keycloak refresh token reuse bypass via toctou race conditionCVE-2026-10353.1 Low
- red hat build of keycloak, build of keycloak 26.4, build of keycloak 26.4.11 +3 more +5 moreOrg.keycloak.protocol.oidc: blind server-side request forgery (ssrf) in keycloak oidc dynamic client registration via jwks_uriCVE-2026-11805.8 Medium
- red hat build of keycloak, build of keycloak 26.4.9, jboss enterprise application platform 8 +1 more +3 moreOrg.keycloak/keycloak-quarkus-server: keycloak: proxy bypass due to improper handling of matrix parameters in url pathsCVE-2026-09763.7 Low
- red hat build of keycloak 26.4, build of keycloak 26.4.10 +1 moreKeycloak: keycloak authorization header parsing leading to potential security control bypassCVE-2026-07075.3 Medium
- red hat build of keycloak 26.4, build of keycloak 26.4.11 +1 moreKeycloak: keycloak idor in realm client creating/deletingCVE-2025-147776.0 Medium
- red hat build of keycloak 26.4, build of keycloak 26.4.11 +1 moreKeycloak-services: keycloak admin rest api: improper access control leads to sensitive role metadata information disclosureCVE-2025-14082Fix available2.7 Low
- keycloak, red hat build of keycloak 26.2, build of keycloak 26.2.11 +2 more +4 moreOrg.keycloak.storage.ldap: keycloak: deserialization of untrusted data in ldap user federationCVE-2025-13467Fix available5.5 Medium
- keycloak, red hat build of keycloak 26.4, build of keycloak 26.4.4 +2 moreKeycloak-server: debug default bind addressCVE-2025-11538Fix available6.8 Medium
- keycloak, red hat build of keycloak 26.2, build of keycloak 26.2.11 +2 more +4 moreOrg.keycloak.protocol.oidc.endpoints.logoutendpoint: offline session takeover due to reused authentication session idCVE-2025-12390Fix available6.0 Medium
- keycloak, red hat build of keycloak 26.4, build of keycloak 26.4.4 +2 moreOrg.keycloak/keycloak-quarkus-server: unable to restrict access to the admin consoleCVE-2025-10939Fix available3.7 Low
- keycloak, red hat build of keycloak 26.2, build of keycloak 26.2.11 +2 more +4 moreKeycloak: org.keycloak:keycloak-services: user can refresh offline session even after client's offline_access scope was removedCVE-2025-12110Fix available5.4 Medium