Red Hat Red Hat build of Keycloak 26.6.5
15 vulnérabilités publiées citent ce produit.
Tel que les CNA l’écrivent dans leurs fiches CVE (éditeur et produit) ; les versions sont les leurs.
| CVE | Versions vulnérables | Titre | Sévérité | Publiée | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-15572 | | Keycloak-services: keycloak-services: dcr protocol mapper type-swap policy bypass allows privilege escalation | HIGH 8.8 | 0.7 % | ||
| CVE-2026-16442 | | Keycloak-services: keycloak-services: saml idp-initiated broker login bypasses link-only restriction | CRITICAL 9.8 | 0.3 % | ||
| CVE-2026-16100 | | Keycloak-services: keycloak-services: unbounded metric cardinality in user event metrics via request-controlled error text | MEDIUM 6.5 | 0.6 % | ||
| CVE-2026-16071 | | Keycloak-services: keycloak-services: ldap entry-dn user search bypasses configured users dn boundary | MEDIUM 5.4 | 0.3 % | ||
| CVE-2026-16102 | | Keycloak-services: keycloak-services: default dcr policy allows role forgery via user property mappers | HIGH 8.1 | 0.5 % | ||
| CVE-2026-15573 | | Keycloak-services: keycloak-services: authorization bypass via unnormalized uri matching in pathmatcher | HIGH 8.1 | 0.5 % | ||
| CVE-2026-16443 | | Keycloak-services: keycloak-services: saml broker metadata import disables response signature validation | CRITICAL 9.1 | 0.3 % | ||
| CVE-2026-14615 | | Keycloak-services: keycloak: fgap v2 parent group children endpoint bypasses per-child view permission filter | MEDIUM 4.3 | 0.4 % | ||
| CVE-2026-14614 | | Keycloak-services: keycloak-services: fgap v2 client scope assignment bypass via clientresource | MEDIUM 5.4 | 0.3 % | ||
| CVE-2026-4629 | | Keycloak: keycloak: privilege escalation through hardcoded role mapper injection | MEDIUM 6.5 | 0.5 % | ||
| CVE-2026-14209 | | Keycloak-admin-ui: keycloak-admin-ui:admin ui extension brute-force-user endpoint bypasses fgapv2 user view restrictions | MEDIUM 4.3 | 0.4 % | ||
| CVE-2026-11986 | | Keycloak-rest-admin-ui-ext: authorization bypass vulnerability in the admin-ui-ext bulk role-mapping-delete endpoints of keycloak | MEDIUM 4.9 | 0.3 % | ||
| CVE-2026-9798 | | Keycloak: keycloak: brute-force protection bypass in ciba flow | MEDIUM 4.3 | 0.4 % | ||
| CVE-2026-9793 | | Keycloak: keycloak: security policy bypass in jwe-encrypted request object processing | HIGH 7.5 | 0.2 % | ||
| CVE-2026-9689 | | Keycloak: org.keycloak.protocol.oidc: http parameter pollution in oidc redirect uri allows response parameter duplication - #ghi-604 | MEDIUM 4.2 | 0.3 % |