Skip to contentRed Hat Build Of Keycloak 26.6.3 vulnerabilities
- red hat build of keycloak 26.4, build of keycloak 26.4.13, build of keycloak 26.6 +1 more +3 moreKeycloak: keycloak: information disclosure due to user profile permission bypassCVE-2026-9088Fix available2.7 Low
- red hat build of keycloak 26.4, build of keycloak 26.4.13, build of keycloak 26.6 +2 more +4 moreKeycloak: keycloak: denial of service via malformed authorization headerCVE-2026-9803Fix available5.3 Medium
- red hat build of keycloak 26.4, build of keycloak 26.4.13, build of keycloak 26.6 +2 more +4 moreKeycloak: keycloak: unauthorized account access via replayed refresh tokens after cluster restartCVE-2026-9802Fix available6.8 Medium
- red hat build of keycloak 26.4, build of keycloak 26.4.13, build of keycloak 26.6 +2 more +4 moreKeycloak: keycloak: denial of service via malformed ldap password policy responseCVE-2026-9801Fix available4.9 Medium
- red hat build of keycloak 26.4, build of keycloak 26.4.13, build of keycloak 26.6 +2 more +4 moreKeycloak: keycloak: information disclosure via saml ecp endpointCVE-2026-9794Public exploitFix available5.3 Medium
- red hat build of keycloak 26.4, build of keycloak 26.4.13, build of keycloak 26.6 +2 more +4 moreKeycloak: keycloak: security restriction bypass allows unauthorized ropc token acquisitionCVE-2026-9792Fix available6.5 Medium
- red hat build of keycloak 26.4, build of keycloak 26.4.13, build of keycloak 26.6 +2 more +4 moreKeycloak-rhel9: organization data leak after feature disabled in keycloakCVE-2026-9791Fix available4.3 Medium
- red hat build of keycloak 26.4, build of keycloak 26.4.13, build of keycloak 26.6 +2 more +4 moreKeycloak: keycloak: privilege escalation due to oversized subject_token jwtCVE-2026-9704Fix available6.8 Medium
- red hat build of keycloak 26.4, build of keycloak 26.4.13, build of keycloak 26.6 +2 more +4 moreKeycloak: cross-session email verification proof not bound to upstream identity in first-broker-loginCVE-2026-9087Fix available6.4 Medium
- red hat build of keycloak 26.4, build of keycloak 26.4.13, build of keycloak 26.6 +2 more +4 moreOrg.keycloak/keycloak-services: keycloak: org.keycloak.protocol.oidc: security flaw in org.keycloak/keycloak-servicesCVE-2026-89225.4 Medium
- red hat build of keycloak 26.4, build of keycloak 26.4.13, build of keycloak 26.6 +2 more +4 moreKeycloak: org.keycloak/keycloak-services: keycloak: policy bypass during webauthn credential registration via client-side javascript manipulationCVE-2026-8830Fix available4.3 Medium
- red hat build of keycloak 26.4, build of keycloak 26.4.13, build of keycloak 26.6 +2 more +4 moreOrg.keycloak.keycloak-services: improper access control on keycloak server when the account account api feature is disabledCVE-2026-75005.4 Medium
- red hat build of keycloak 26.4, build of keycloak 26.4.13, build of keycloak 26.6 +2 more +4 moreKeycloak: org.keycloak.protocol.oidc.grants.ciba: keycloak: information disclosure via cors header injection due to unvalidated jwt azp claimCVE-2026-37977Fix available3.7 Low
- red hat build of keycloak, build of keycloak 26.4, build of keycloak 26.4.13 +7 more +9 moreOrg.keycloak.protocol.oidc.grants: org.keycloak.services.managers: keycloak: server-side request forgery via oidc token endpoint manipulationCVE-2026-4874Fix available3.1 Low