Red Hat Red Hat build of Keycloak 26.4
86 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-19607 | fixed in 26.4.16-2 | Keycloak-services: keycloak-services: broker-originated username collision causes account lockout | MEDIUM 5.3 | 0.7 % | ||
| CVE-2026-17526 | fixed in 26.4.16-2 | Keycloak-services: keycloak-services: privilege escalation via impersonation role allows takeover of realm administrator accounts | HIGH 7.2 | 0.6 % | ||
| CVE-2026-79651 | fixed in 26.4.16-2 | Keycloak-services: keycloak-services: unauthenticated dos via unbounded locale caching | HIGH 7.5 | 0.8 % | ||
| CVE-2026-74909 | fixed in 26.4.16-2 | Keycloak-services: keycloak-services: incomplete fix for cve-2026-15573 allows policy enforcer bypass via percent-encoded uri segments | HIGH 8.1 | 0.8 % | ||
| CVE-2026-18212 | fixed in 26.4.16-2 | Keycloak-services: keycloak-services: saml redirect deflate helpers leak native zlib state | HIGH 7.5 | 0.7 % | ||
| CVE-2026-19729 | fixed in 26.4.16-2 | Keycloak-services: keycloak-services: incomplete fix for arbitrary filesystem path probing via keystore parameters | MEDIUM 4.9 | 0.6 % | ||
| CVE-2026-18963 | fixed in 26.4.15-1 | Keycloak-services: keycloak-services: unauthenticated account takeover via reset-credentials flow bypass | CRITICAL 9.1 | 4.7 % | ||
| CVE-2026-15572 | fixed in 26.4.14-1 | Keycloak-services: keycloak-services: dcr protocol mapper type-swap policy bypass allows privilege escalation | HIGH 8.8 | 0.7 % | ||
| CVE-2026-16442 | fixed in 26.4.14-1 | Keycloak-services: keycloak-services: saml idp-initiated broker login bypasses link-only restriction | CRITICAL 9.8 | 0.3 % | ||
| CVE-2026-16071 | fixed in 26.4.14-1 | Keycloak-services: keycloak-services: ldap entry-dn user search bypasses configured users dn boundary | MEDIUM 5.4 | 0.3 % | ||
| CVE-2026-16102 | fixed in 26.4.14-1 | Keycloak-services: keycloak-services: default dcr policy allows role forgery via user property mappers | HIGH 8.1 | 0.5 % | ||
| CVE-2026-15573 | fixed in 26.4.14-1 | Keycloak-services: keycloak-services: authorization bypass via unnormalized uri matching in pathmatcher | HIGH 8.1 | 0.5 % | ||
| CVE-2026-16443 | fixed in 26.4.14-1 | Keycloak-services: keycloak-services: saml broker metadata import disables response signature validation | CRITICAL 9.1 | 0.3 % | ||
| CVE-2026-14615 | fixed in 26.4.14-1 | Keycloak-services: keycloak: fgap v2 parent group children endpoint bypasses per-child view permission filter | MEDIUM 4.3 | 0.4 % | ||
| CVE-2026-14614 | fixed in 26.4.14-1 | Keycloak-services: keycloak-services: fgap v2 client scope assignment bypass via clientresource | MEDIUM 5.4 | 0.3 % | ||
| CVE-2026-4629 | fixed in 26.4.14-1 | Keycloak: keycloak: privilege escalation through hardcoded role mapper injection | MEDIUM 6.5 | 0.5 % | ||
| CVE-2026-14209 | fixed in 26.4.14-1 | Keycloak-admin-ui: keycloak-admin-ui:admin ui extension brute-force-user endpoint bypasses fgapv2 user view restrictions | MEDIUM 4.3 | 0.4 % | ||
| CVE-2026-9083 | fixed in 26.4.13-1 | Keycloak: keycloak: information disclosure through arbitrary filesystem path probing | MEDIUM 4.9 | 0.8 % | ||
| CVE-2026-9799 | fixed in 26.4.13-1 | Keycloak: keycloak: unauthorized access to resources via uma permission ticket bypass | MEDIUM 4.6 | 0.3 % | ||
| CVE-2026-9705 | fixed in 26.4.13-1 | Keycloak: keycloak: attacker can re-enable and take over disabled clients via registration access token | MEDIUM 6.5 | 0.5 % | ||
| CVE-2026-9086 | fixed in 26.4.13-1 | Keycloak: keycloak: cross-site scripting (xss) via case-insensitive uri validation bypass | HIGH 7.3 | 0.8 % | ||
| CVE-2026-9099 | fixed in 26.4.13-1 | Keycloak: group-admin escalation to realm-admin | HIGH 7.7 | 0.5 % | ||
| CVE-2026-9800 | fixed in 26.4.13-1 | Keycloak-policy-enforcer: keycloak policy enforcer: authorization bypass via incorrect uri comparison | HIGH 8.1 | 0.7 % | ||
| CVE-2026-9088 | fixed in 26.4.13-1 | Keycloak: keycloak: information disclosure due to user profile permission bypass | LOW 2.7 | 0.3 % | ||
| CVE-2026-9803 | fixed in 26.4.13-1 | Keycloak: keycloak: denial of service via malformed authorization header | MEDIUM 5.3 | 0.4 % | ||
| CVE-2026-9802 | fixed in 26.4.13-1 | Keycloak: keycloak: unauthorized account access via replayed refresh tokens after cluster restart | MEDIUM 6.8 | 0.3 % | ||
| CVE-2026-9801 | fixed in 26.4.13-1 | Keycloak: keycloak: denial of service via malformed ldap password policy response | MEDIUM 4.9 | 0.5 % | ||
| CVE-2026-9798 | fixed in 26.4.14-1 | Keycloak: keycloak: brute-force protection bypass in ciba flow | MEDIUM 4.3 | 0.4 % | ||
| CVE-2026-9795 | fixed in 26.4.13-1 | Keycloak: keycloak: privilege escalation via improper scope mapping enforcement | HIGH 7.3 | 0.4 % | ||
| CVE-2026-9794 | fixed in 26.4.13-1 | Keycloak: keycloak: information disclosure via saml ecp endpoint | MEDIUM 5.3 | 0.4 % | ||
| CVE-2026-9792 | fixed in 26.4.13-1 | Keycloak: keycloak: security restriction bypass allows unauthorized ropc token acquisition | MEDIUM 6.5 | 0.3 % | ||
| CVE-2026-9793 | fixed in 26.4.14-1 | Keycloak: keycloak: security policy bypass in jwe-encrypted request object processing | HIGH 7.5 | 0.2 % | ||
| CVE-2026-9791 | fixed in 26.4.13-1 | Keycloak-rhel9: organization data leak after feature disabled in keycloak | MEDIUM 4.3 | 0.2 % | ||
| CVE-2026-9704 | fixed in 26.4.13-1 | Keycloak: keycloak: privilege escalation due to oversized subject_token jwt | HIGH 8.8 | 0.3 % | ||
| CVE-2026-9689 | fixed in 26.4.14-1 | Keycloak: org.keycloak.protocol.oidc: http parameter pollution in oidc redirect uri allows response parameter duplication - #ghi-604 | MEDIUM 4.2 | 0.3 % | ||
| CVE-2026-9087 | fixed in 26.4.13-1 | Keycloak: cross-session email verification proof not bound to upstream identity in first-broker-login | HIGH 8.1 | 0.3 % | ||
| CVE-2026-7571 | fixed in 26.4.12-1 | Keycloak: keycloak: access token disclosure and implicit flow bypass via forged client data | HIGH 7.1 | 0.4 % | ||
| CVE-2026-7507 | fixed in 26.4.12-1 | Org.keycloak/keycloak-services: session fixation in oidc login flow that can lead to account takeover | HIGH 7.5 | 0.8 % | ||
| CVE-2026-7504 | fixed in 26.4.12-1 | Org.keycloak/keycloak-services: open redirect when using wildcard valid redirect uris in keycloak | HIGH 8.1 | 0.5 % | ||
| CVE-2026-37982 | fixed in 26.4.12-1 | Keycloak: org.keycloak.authentication: keycloak: unauthorized account takeover via webauthn token replay | MEDIUM 6.8 | 0.4 % | ||
| CVE-2026-37979 | fixed in 26.4.12-1 | Keycloak: keycloak: information disclosure via oidc token introspection endpoint audience bypass | MEDIUM 6.5 | 0.4 % | ||
| CVE-2026-37978 | fixed in 26.4.12-1 | Keycloak: org.keycloak.services: keycloak: information disclosure via evaluate-scopes admin api | MEDIUM 4.9 | 0.4 % | ||
| CVE-2026-7307 | | Keycloak: keycloak: denial of service via specially crafted saml input | HIGH 7.5 | 0.9 % | ||
| CVE-2026-37981 | fixed in 26.4.12-1 | Keycloak: org.keycloak.authorization: keycloak: information disclosure via broken access control in user lookup endpoint | MEDIUM 4.3 | 0.4 % | ||
| CVE-2026-4630 | fixed in 26.4.12-1 | Keycloak: keycloak: unauthorized resource access and data modification via insecure direct object reference | MEDIUM 6.8 | 0.3 % | ||
| CVE-2026-8922 | fixed in 26.4.13-1 | Org.keycloak/keycloak-services: keycloak: org.keycloak.protocol.oidc: security flaw in org.keycloak/keycloak-services | MEDIUM 5.4 | 0.3 % | ||
| CVE-2026-8830 | fixed in 26.4.13-1 | Keycloak: org.keycloak/keycloak-services: keycloak: policy bypass during webauthn credential registration via client-side javascript mani… | MEDIUM 4.3 | 0.4 % | ||
| CVE-2026-7500 | fixed in 26.4.13-1 | Org.keycloak.keycloak-services: improper access control on keycloak server when the account account api feature is disabled | MEDIUM 5.4 | 0.2 % | ||
| CVE-2026-37977 | fixed in 26.4.13-1 | Keycloak: org.keycloak.protocol.oidc.grants.ciba: keycloak: information disclosure via cors header injection due to unvalidated jwt azp c… | MEDIUM 5.3 | 0.3 % | ||
| CVE-2026-4636 | fixed in 26.4.11-1 | Keycloak: keycloak: uma policy bypass allows authenticated users to gain unauthorized access to victim-owned resources. | HIGH 8.1 | 0.4 % | ||
| CVE-2026-4634 | fixed in 26.4.11-1 | Keycloak: keycloak: denial of service via excessive processing of openid connect scope parameters | HIGH 7.5 | 0.6 % | ||
| CVE-2026-4325 | fixed in 26.4.11-1 | Keycloak: keycloak: replay of action tokens via improper handling of single-use entries | MEDIUM 5.3 | 0.3 % | ||
| CVE-2026-4282 | fixed in 26.4.11-1 | Keycloak: keycloak: privilege escalation via forged authorization codes due to singleuseobjectprovider isolation flaw | HIGH 7.4 | 0.4 % | ||
| CVE-2026-3872 | fixed in 26.4.11-1 | Keycloak: keycloak: information disclosure due to redirect_uri validation bypass | HIGH 7.3 | 0.4 % | ||
| CVE-2026-3121 | fixed in 26.4.11-1 | Keycloak: org.keycloak/keycloak-services: keycloak: privilege escalation via manage-clients permission | HIGH 7.2 | 0.5 % | ||
| CVE-2026-3190 | fixed in 26.4.11-1 | Keycloak: keycloak: information disclosure via improper role enforcement in uma 2.0 protection api | MEDIUM 4.3 | 0.3 % | ||
| CVE-2026-4874 | fixed in 26.4.13-1 | Org.keycloak.protocol.oidc.grants: org.keycloak.services.managers: keycloak: server-side request forgery via oidc token endpoint manipula… | LOW 3.1 | 0.4 % | ||
| CVE-2026-4366 | fixed in 26.4.12-1 | Keycloak-services: blind server-side request forgery (ssrf) via http redirect handling in keycloak | MEDIUM 5.8 | 0.2 % | ||
| CVE-2026-2575 | fixed in 26.4.10-1 | Keycloak: keycloak: denial of service due to excessive samlrequest decompression | MEDIUM 5.3 | 0.6 % | ||
| CVE-2026-2603 | fixed in 26.4.10-1 | Keycloak: keycloak: unauthorized authentication via disabled saml identity provider | HIGH 8.1 | 0.4 % | ||
| CVE-2026-2092 | fixed in 26.4.10-1 | Keycloak-services: keycloak: unauthorized access via improper validation of encrypted saml assertions | HIGH 7.7 | 0.4 % | ||
| CVE-2026-2366 | fixed in 26.4.11-1 | Keycloak: keycloak: information disclosure via authorization bypass in admin api | LOW 3.1 | 0.3 % | ||
| CVE-2026-3429 | fixed in 26.4.11-1 | Org.keycloak.services.resources.account: improper access control leading to mfa deletion and account takeover in keycloak account rest api | MEDIUM 4.2 | 0.3 % | ||
| CVE-2026-3911 | fixed in 26.4.11-1 | Org.keycloak.services.resources.admin.userresource: keycloak: information disclosure of disabled user attributes via administrative endpoint | LOW 2.7 | 0.3 % | ||
| CVE-2026-3047 | fixed in 26.4.10-1 | Org.keycloak.broker.saml: keycloak saml broker: authentication bypass due to disabled saml client completing idp-initiated login | HIGH 8.8 | 0.5 % | ||
| CVE-2026-3009 | fixed in 26.4.10-1 | Org.keycloak/keycloak-services: improper enforcement of disabled identity provider in identitybrokerservice (authentication bypass) | HIGH 8.1 | 0.4 % | ||
| CVE-2025-12150 | | Org.keycloak/keycloak-services: webauthn attestation statement verification bypass | LOW 3.1 | 0.2 % | ||
| CVE-2026-0871 | fixed in 26.4.9-1 | Org.keycloak/keycloak-services: keycloak: unauthorized modification of unmanaged user attributes by administrators | MEDIUM 4.9 | 0.3 % | ||
| CVE-2026-2733 | fixed in 26.4.10-1 | Org.keycloak/keycloak-services: keycloak: missing check on disabled client for docker registry protocol | LOW 3.8 | 0.4 % | ||
| CVE-2025-14778 | fixed in 26.4.9-1 | Keycloak: incorrect ownership checks in /uma-policy/ | MEDIUM 5.4 | 0.3 % | ||
| CVE-2026-1529 | fixed in 26.4.9-1 | Org.keycloak.services.resources.organizations: keycloak: unauthorized organization registration via improper invitation token validation | HIGH 8.1 | 0.5 % | ||
| CVE-2026-1486 | fixed in 26.4.9-1 | Org.keycloak.protocol.oidc.grants: disabled identity providers are still accepted for jwt authorization grant | HIGH 8.8 | 0.5 % | ||
| CVE-2025-13881 | fixed in 26.4.9-1 | Org.keycloak.services.resources.admin: keycloak: limited administrator can retrieve sensitive user attributes via admin api | LOW 2.7 | 0.4 % | ||
| CVE-2026-1190 | fixed in 26.4.10-1 | Org.keycloak/keycloak-services: keycloak saml brokering: response delay due to unchecked notonorafter in subjectconfirmationdata | LOW 3.1 | 0.4 % | ||
| CVE-2025-14083 | fixed in 26.4.11-1 | Keycloak-server: keycloak: improper access control in admin rest api leads to information disclosure | LOW 2.7 | 0.4 % | ||
| CVE-2025-14559 | fixed in 26.4.9-1 | Org.keycloak/keycloak-services: keycloak keycloak-services: business logic flaw allows unauthorized token issuance for disabled users | MEDIUM 6.5 | 0.5 % | ||
| CVE-2026-1035 | fixed in 26.4.11-1 | Org.keycloak.protocol.oidc: keycloak refresh token reuse bypass via toctou race condition | LOW 3.1 | 0.3 % | ||
| CVE-2026-1180 | fixed in 26.4.11-1 | Org.keycloak.protocol.oidc: blind server-side request forgery (ssrf) in keycloak oidc dynamic client registration via jwks_uri | MEDIUM 5.8 | 0.4 % | ||
| CVE-2026-0707 | fixed in 26.4.10-1 | Keycloak: keycloak authorization header parsing leading to potential security control bypass | MEDIUM 5.3 | 0.4 % | ||
| CVE-2025-14777 | fixed in 26.4.11-1 | Keycloak: keycloak idor in realm client creating/deleting | MEDIUM 6.0 | 0.3 % | ||
| CVE-2025-14082 | fixed in 26.4.11-1 | Keycloak-services: keycloak admin rest api: improper access control leads to sensitive role metadata information disclosure | LOW 2.7 | 0.4 % | ||
| CVE-2025-13467 | | Org.keycloak.storage.ldap: keycloak: deserialization of untrusted data in ldap user federation | MEDIUM 5.5 | 0.5 % | ||
| CVE-2025-11538 | fixed in 26.4.4-1 | Keycloak-server: debug default bind address | MEDIUM 6.8 | 0.4 % | ||
| CVE-2025-12390 | | Org.keycloak.protocol.oidc.endpoints.logoutendpoint: offline session takeover due to reused authentication session id | MEDIUM 6.0 | 0.1 % | ||
| CVE-2025-10939 | fixed in 26.4.4-1 | Org.keycloak/keycloak-quarkus-server: unable to restrict access to the admin console | LOW 3.7 | 0.4 % | ||
| CVE-2025-12110 | | Keycloak: org.keycloak:keycloak-services: user can refresh offline session even after client's offline_access scope was removed | MEDIUM 5.4 | 0.3 % |