Skip to contentRed Hat Single Sign-on vulnerabilities
- keycloak keycloak-services, red hat build of keycloak, single sign-on 7 +2 moreKeycloak-services: keycloak-services: login-failure upsert trusts mysql/mariadb affected-row countCVE-2026-1122014.8 Medium
- red hat build of keycloak, single sign-on 7 +1 moreKeycloak-services: keycloak-services: delegated admin escalates to realm-admin via group moveCVE-2026-1164686.6 Medium
- red hat build of keycloak, single sign-on 7 +1 moreKeycloak-services: keycloak-services: client-level mandatory pkce bypass via login-actions entry pointCVE-2026-1256526.8 Medium
- red hat fuse 7, jboss enterprise application platform 7, jboss enterprise application platform 8.1 +5 more +7 moreOrg.wildfly.core/wildfly-server: wildfly: rbac bypass in wildfly deployment-operation handlers leads to privilege escalationCVE-2026-129778.8 High
- red hat build of keycloak, single sign-on 7 +1 moreKeycloak-services: keycloak-services: manage-clients to arbitrary code execution through inline javascript policy importCVE-2026-1209849.1 Critical
- red hat build of keycloak 26.4, build of keycloak 26.4.17, build of keycloak 26.6 +2 more +4 moreKeycloak-services: keycloak-services: protocol mapper with jsontype=json bypasses token sanitizationCVE-2026-978486.5 Medium
- red hat build of keycloak 26.4, build of keycloak 26.4.17, build of keycloak 26.6 +2 more +4 moreKeycloak-services: keycloak-services: dcr azp and sid claim substitution allows account rest session takeoverCVE-2026-973676.4 Medium
- red hat build of keycloak 26.4, build of keycloak 26.4.17, build of keycloak 26.6 +2 more +4 moreKeycloak-services: keycloak-services: dcr registration-time claim-path gap allows forging realm_access.rolesCVE-2026-965476.5 Medium
- red hat build of keycloak 26.6, build of keycloak 26.6.8, single sign-on 7 +2 moreKeycloak-services: keycloak-services: indefinite access token renewal via standard token exchange v2CVE-2026-964605.4 Medium
- red hat build of keycloak 26.6, build of keycloak 26.6.8, single sign-on 7 +2 moreKeycloak-services: keycloak-services: saml broker ignores proxyrestriction delegation constraintsCVE-2026-928564.9 Medium
- red hat build of keycloak 26.6, build of keycloak 26.6.8, single sign-on 7 +2 moreKeycloak-services: keycloak-services: admin api missing audience checkCVE-2026-196886.8 Medium
- red hat build of keycloak 26.6, build of keycloak 26.6.8, single sign-on 7 +2 moreKeycloak-services: keycloak-services: stateless token preferred_username fallback enables identity rebindingCVE-2026-964474.2 Medium
- red hat build of keycloak 26.6, build of keycloak 26.6.8, single sign-on 7 +2 moreKeycloak-services: keycloak-services: injection of roles into realm default-roles via dcr endpointCVE-2026-1090816.8 Medium
- red hat build of keycloak 26.6, build of keycloak 26.6.8, single sign-on 7 +2 moreKeycloak-services: keycloak-services: oidc logout endpoint session fixation via id_token_hint leading to account takeoverCVE-2026-1071246.4 Medium
- red hat build of keycloak 26.4, build of keycloak 26.4.17, build of keycloak 26.6 +2 more +4 moreKeycloak-services: keycloak-services: client manager can substitute sessionless token principal via hardcoded-claim mappers to obtain realm administrator authorityCVE-2026-978477.1 High
- red hat build of keycloak 26.4.17, build of keycloak 26.6.8, single sign-on 7 +2 moreKeycloak-services: keycloak-services: unverified idp email auto-linking enables account takeoverCVE-2026-971758.8 High
- red hat build of keycloak 26.6, build of keycloak 26.6.8, single sign-on 7 +2 moreKeycloak-services: keycloak-services: ciba sub parameter injection causes attacker authentication to issue victim tokensCVE-2026-971746.8 Medium
- red hat amq broker 7, build of keycloak 26.4, build of keycloak 26.4.17 +8 more +10 moreOrg.keycloak/keycloak-admin-cli: keycloak-admin-cli: kcadm custom truststore accepts arbitrary self-signed certificatesCVE-2026-964538.0 High
- red hat amq broker 7, build of keycloak 26.4, build of keycloak 26.4.17 +8 more +10 moreKeycloak-core: keycloak-core: saml adapter does not bind signed assertions to the configured identity provider issuerCVE-2026-939987.4 High
- red hat build of keycloak 26.4, build of keycloak 26.4.17, build of keycloak 26.6 +2 more +4 moreKeycloak-services: keycloak-services: dcr protocol mapper config not validated, allowing iat holders to forge sub and aud claims in signed tokensCVE-2026-928578.1 High
- red hat build of keycloak 26.4, build of keycloak 26.4.17, build of keycloak 26.6 +2 more +4 moreKeycloak-services: keycloak-services: saml broker accepts holder-of-key assertions without proof of key possessionCVE-2026-928557.4 High
- red hat build of keycloak 26.4, build of keycloak 26.4.17, build of keycloak 26.6 +2 more +4 moreKeycloak-services: keycloak-services: unauthenticated denial of service via saml soap endpoint unbounded xml parsingCVE-2026-829657.5 High
- red hat build of keycloak 26.4, build of keycloak 26.4.17, build of keycloak 26.6 +2 more +4 moreKeycloak-services: keycloak-services: uma protection api resourcetype field not validated — cross-owner resource accessCVE-2026-1142328.1 High
- red hat build of keycloak 26.6, build of keycloak 26.6.8, single sign-on 7 +2 moreKeycloak-services: keycloak-services: account takeover via stale sso_auth note in organization identity-first loginCVE-2026-1122088.1 High
- red hat build of keycloak 26.6, build of keycloak 26.6.8, single sign-on 7 +2 moreKeycloak-services: keycloak-services: unauthenticated persistent disk exhaustion via theme gzip cacheCVE-2026-1109327.5 High
- red hat build of keycloak 26.4, build of keycloak 26.4.17, build of keycloak 26.6 +2 more +4 moreKeycloak-services: keycloak-services: unauthenticated jvm termination via saml 1.1 authoritybinding parsing loopCVE-2026-1109317.5 High
- red hat build of keycloak 26.4, build of keycloak 26.4.17, build of keycloak 26.6 +2 more +4 moreKeycloak-services: keycloak-services: unauthenticated cpu exhaustion via saml 1.1 keyinfo infinite loopCVE-2026-1076027.5 High
- red hat build of keycloak 26.6, build of keycloak 26.6.8, single sign-on 7 +2 moreKeycloak-services: keycloak-services: unauthenticated cpu denial of service via saml xml datetime and duration parsingCVE-2026-1071237.5 High
- red hat build of keycloak 26.4, build of keycloak 26.4.17, build of keycloak 26.6 +2 more +4 moreKeycloak-services: keycloak-services: account takeover via authentication race using reset-credentials pathCVE-2026-1031127.5 High
- red hat build of keycloak 26.6, build of keycloak 26.6.9, single sign-on 7 +2 moreKeycloak-services: keycloak-services: saml redirect binding signature bypass via percent-encoded parameter namesCVE-2026-117691Public exploit9.1 Critical
- red hat build of apache camel for spring boot 4, enterprise linux 8, enterprise linux 9 +5 more +7 moreUndertow: undertow: chunkreader message length permits chunk-size overflowCVE-2026-919206.5 Medium
- red hat build of keycloak, single sign-on 7 +1 moreKeycloak-services: keycloak-services: required actions bypassed via kc_action parameterCVE-2026-1189595.4 Medium
- red hat build of keycloak, single sign-on 7 +1 moreKeycloak-services: keycloak-services: authorization bypass via uma resource registration idorCVE-2026-1189474.3 Medium
- red hat build of keycloak, single sign-on 7 +1 moreKeycloak-services: keycloak-services: redirect uri domain allowlist bypass via dns resolution to loopbackCVE-2026-1184256.8 Medium
- red hat build of keycloak, single sign-on 7 +1 moreKeycloak-services: keycloak-services: hotp race condition allows single otp code reuse across concurrent loginsCVE-2026-1180304.2 Medium
- red hat build of keycloak, single sign-on 7 +1 moreKeycloak-services: keycloak-services: par single-use bypass via flow restartCVE-2026-1178595.4 Medium
- red hat build of keycloak, single sign-on 7 +1 moreKeycloak-services: keycloak-services: vault secret disclosure via client registration installation configurationCVE-2026-1176885.3 Medium
- red hat build of keycloak, single sign-on 7 +1 moreKeycloak-services: keycloak-services: jwt authorization grant bypasses identity provider login restrictionsCVE-2026-1176275.4 Medium
- red hat fuse 7, jboss enterprise application platform 7, jboss enterprise application platform 8.1 +2 more +4 moreWildfly: wildfly-iiop: wildfly-ejb3: wildfly: authentication bypass on iiop ejb invocations as csiv2 ittprincipalname accepted without transport bindingCVE-2026-1144887.4 High
- red hat jboss enterprise application platform 7, jboss enterprise application platform 8.1, jboss enterprise application platform expansion pack +1 more +3 moreWildfly-platform-mbean: wildfly-platform-mbean: rbac sensitive attribute read bypass for platform runtimemxbeanCVE-2026-196106.5 Medium
- red hat build of keycloak, single sign-on 7 +1 moreKeycloak-services: keycloak-services: required otp enrollment bypassed via update user locale required action orderingCVE-2026-1144384.2 Medium
- red hat build of apache camel for spring boot 4, enterprise linux 8, enterprise linux 9 +5 more +7 moreUndertow: undertow: pathresourcemanager safepaths check allows sibling-directory symlink traversalCVE-2026-1143703.7 Low
- red hat enterprise linux 8, enterprise linux 9, fuse 7 +4 more +6 moreOrg.wildfly.core: wildfly: path traversal in take-snapshot discloses the server configuration to the monitor roleCVE-2026-848237.1 High
- red hat fuse 7, jboss enterprise application platform 7, jboss enterprise application platform 8.1 +2 more +4 moreWildfly-core: wildfly-core: deployer rbac role privilege escalation via path traversal in deployment nameCVE-2026-856348.8 High
- red hat build of keycloak, single sign-on 7 +1 moreKeycloak-services: keycloak-services: ciba confidential-only contract not enforced for public clientsCVE-2026-1090826.8 Medium
- red hat build of keycloak 26.6, build of keycloak 26.6.8, single sign-on 7 +2 moreKeycloak-services: keycloak-services: stored xss on login page via kcsanitize bypassCVE-2026-1078895.5 Medium
- red hat build of keycloak 26.6, build of keycloak 26.6.8, single sign-on 7 +2 moreKeycloak-services: keycloak-services: oidc dcr read-modify-write silently disables offline token revocationCVE-2026-1076234.3 Medium
- red hat build of keycloak, single sign-on 7 +1 moreKeycloak-services: keycloak-services: view-clients role allows retrieval of active client secrets via installation provider endpointsCVE-2026-1076044.9 Medium
- red hat build of keycloak 26.6, build of keycloak 26.6.8, single sign-on 7 +2 moreKeycloak-services: keycloak-services: smtp starttls plaintext credential and message downgradeCVE-2026-1071216.5 Medium
- red hat build of keycloak 26.6, build of keycloak 26.6.8, single sign-on 7 +2 moreKeycloak-services: keycloak-services: device authorization grant bypasses per-client minimum.acr.value enforcementCVE-2026-1053055.4 Medium
- Show moreLoading…