Red Hat Red Hat build of Keycloak 26.4.14
14 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-15572 | | Keycloak-services: keycloak-services: dcr protocol mapper type-swap policy bypass allows privilege escalation | HIGH 8.8 | 0.7 % | ||
| CVE-2026-16442 | | Keycloak-services: keycloak-services: saml idp-initiated broker login bypasses link-only restriction | CRITICAL 9.8 | 0.3 % | ||
| CVE-2026-16071 | | Keycloak-services: keycloak-services: ldap entry-dn user search bypasses configured users dn boundary | MEDIUM 5.4 | 0.3 % | ||
| CVE-2026-16102 | | Keycloak-services: keycloak-services: default dcr policy allows role forgery via user property mappers | HIGH 8.1 | 0.5 % | ||
| CVE-2026-15573 | | Keycloak-services: keycloak-services: authorization bypass via unnormalized uri matching in pathmatcher | HIGH 8.1 | 0.5 % | ||
| CVE-2026-16443 | | Keycloak-services: keycloak-services: saml broker metadata import disables response signature validation | CRITICAL 9.1 | 0.3 % | ||
| CVE-2026-14615 | | Keycloak-services: keycloak: fgap v2 parent group children endpoint bypasses per-child view permission filter | MEDIUM 4.3 | 0.4 % | ||
| CVE-2026-14614 | | Keycloak-services: keycloak-services: fgap v2 client scope assignment bypass via clientresource | MEDIUM 5.4 | 0.3 % | ||
| CVE-2026-4629 | | Keycloak: keycloak: privilege escalation through hardcoded role mapper injection | MEDIUM 6.5 | 0.5 % | ||
| CVE-2026-14209 | | Keycloak-admin-ui: keycloak-admin-ui:admin ui extension brute-force-user endpoint bypasses fgapv2 user view restrictions | MEDIUM 4.3 | 0.4 % | ||
| CVE-2026-9800 | | Keycloak-policy-enforcer: keycloak policy enforcer: authorization bypass via incorrect uri comparison | HIGH 8.1 | 0.7 % | ||
| CVE-2026-9798 | | Keycloak: keycloak: brute-force protection bypass in ciba flow | MEDIUM 4.3 | 0.4 % | ||
| CVE-2026-9793 | | Keycloak: keycloak: security policy bypass in jwe-encrypted request object processing | HIGH 7.5 | 0.2 % | ||
| CVE-2026-9689 | | Keycloak: org.keycloak.protocol.oidc: http parameter pollution in oidc redirect uri allows response parameter duplication - #ghi-604 | MEDIUM 4.2 | 0.3 % |