Red Hat Red Hat build of Keycloak 26.2
26 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-7507 | fixed in 26.2.16-1 | Org.keycloak/keycloak-services: session fixation in oidc login flow that can lead to account takeover | HIGH 7.5 | 0.8 % | ||
| CVE-2026-7504 | fixed in 26.2.16-1 | Org.keycloak/keycloak-services: open redirect when using wildcard valid redirect uris in keycloak | HIGH 8.1 | 0.5 % | ||
| CVE-2026-7307 | fixed in 26.2.16-1 | Keycloak: keycloak: denial of service via specially crafted saml input | HIGH 7.5 | 0.9 % | ||
| CVE-2026-4636 | fixed in 26.2.15-1 | Keycloak: keycloak: uma policy bypass allows authenticated users to gain unauthorized access to victim-owned resources. | HIGH 8.1 | 0.4 % | ||
| CVE-2026-4634 | fixed in 26.2.15-1 | Keycloak: keycloak: denial of service via excessive processing of openid connect scope parameters | HIGH 7.5 | 0.6 % | ||
| CVE-2026-4325 | fixed in 26.2.15-1 | Keycloak: keycloak: replay of action tokens via improper handling of single-use entries | MEDIUM 5.3 | 0.3 % | ||
| CVE-2026-4282 | fixed in 26.2.15-1 | Keycloak: keycloak: privilege escalation via forged authorization codes due to singleuseobjectprovider isolation flaw | HIGH 7.4 | 0.4 % | ||
| CVE-2026-3872 | fixed in 26.2.15-1 | Keycloak: keycloak: information disclosure due to redirect_uri validation bypass | HIGH 7.3 | 0.4 % | ||
| CVE-2026-2603 | fixed in 26.2.14-1 | Keycloak: keycloak: unauthorized authentication via disabled saml identity provider | HIGH 8.1 | 0.4 % | ||
| CVE-2026-2092 | fixed in 26.2.14-1 | Keycloak-services: keycloak: unauthorized access via improper validation of encrypted saml assertions | HIGH 7.7 | 0.4 % | ||
| CVE-2026-3047 | fixed in 26.2.14-1 | Org.keycloak.broker.saml: keycloak saml broker: authentication bypass due to disabled saml client completing idp-initiated login | HIGH 8.8 | 0.5 % | ||
| CVE-2025-12150 | fixed in 26.2.11-1 | Org.keycloak/keycloak-services: webauthn attestation statement verification bypass | LOW 3.1 | 0.2 % | ||
| CVE-2025-14778 | fixed in 26.2.13-1 | Keycloak: incorrect ownership checks in /uma-policy/ | MEDIUM 5.4 | 0.3 % | ||
| CVE-2026-1529 | fixed in 26.2.13-1 | Org.keycloak.services.resources.organizations: keycloak: unauthorized organization registration via improper invitation token validation | HIGH 8.1 | 0.5 % | ||
| CVE-2025-11419 | | Keycloak: keycloak tls client-initiated renegotiation denial of service | HIGH 7.5 | 0.7 % | ||
| CVE-2025-13467 | fixed in 26.2.11-1 | Org.keycloak.storage.ldap: keycloak: deserialization of untrusted data in ldap user federation | MEDIUM 5.5 | 0.5 % | ||
| CVE-2025-12390 | fixed in 26.2.11-1 | Org.keycloak.protocol.oidc.endpoints.logoutendpoint: offline session takeover due to reused authentication session id | MEDIUM 6.0 | 0.1 % | ||
| CVE-2025-12110 | fixed in 26.2.11-1 | Keycloak: org.keycloak:keycloak-services: user can refresh offline session even after client's offline_access scope was removed | MEDIUM 5.4 | 0.3 % | ||
| CVE-2025-11429 | fixed in 26.2.11-1 | Keycloak-server: too long and not settings compliant session | MEDIUM 5.4 | 0.2 % | ||
| CVE-2025-10044 | | Keycloak: keycloak error_description injection on error pages | MEDIUM 4.3 | 0.3 % | ||
| CVE-2025-9162 | | Org.keycloak/keycloak-model-storage-service: variable injection into environment variables | MEDIUM 4.9 | 0.5 % | ||
| CVE-2025-8419 | | Org.keycloak/keycloak-services: keycloak smtp inject vulnerability | MEDIUM 5.3 | 0.6 % | ||
| CVE-2025-7784 | fixed in 26.2.6-1 | Org.keycloak/keycloak-services: privilege escalation in keycloak admin console (fgapv2 enabled) | MEDIUM 6.5 | 0.5 % | ||
| CVE-2025-7365 | | Keycloak: phishing attack via email verification step in first login flow | HIGH 7.1 | 0.3 % | ||
| CVE-2025-3501 | | Org.keycloak.protocol.services: keycloak hostname verification | HIGH 8.2 | 0.5 % | ||
| CVE-2024-12397 | | Io.quarkus.http/quarkus-http-core: quarkus http cookie smuggling | HIGH 7.4 | 0.9 % |