Red Hat Red Hat build of Keycloak 26.4.9
7 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-0871 | | Org.keycloak/keycloak-services: keycloak: unauthorized modification of unmanaged user attributes by administrators | MEDIUM 4.9 | 0.3 % | ||
| CVE-2025-14778 | | Keycloak: incorrect ownership checks in /uma-policy/ | MEDIUM 5.4 | 0.3 % | ||
| CVE-2026-1529 | | Org.keycloak.services.resources.organizations: keycloak: unauthorized organization registration via improper invitation token validation | HIGH 8.1 | 0.5 % | ||
| CVE-2026-1486 | | Org.keycloak.protocol.oidc.grants: disabled identity providers are still accepted for jwt authorization grant | HIGH 8.8 | 0.5 % | ||
| CVE-2025-13881 | | Org.keycloak.services.resources.admin: keycloak: limited administrator can retrieve sensitive user attributes via admin api | LOW 2.7 | 0.4 % | ||
| CVE-2025-14559 | | Org.keycloak/keycloak-services: keycloak keycloak-services: business logic flaw allows unauthorized token issuance for disabled users | MEDIUM 6.5 | 0.5 % | ||
| CVE-2026-0976 | | Org.keycloak/keycloak-quarkus-server: keycloak: proxy bypass due to improper handling of matrix parameters in url paths | LOW 3.7 | 0.5 % |