Red Hat Red Hat build of Keycloak 26.0

• CVE-2025-11419 High 7.5 Keycloak: keycloak tls client-initiated renegotiation denial of service 0.7%
• CVE-2025-10044 Medium 4.3 Keycloak: keycloak error_description injection on error pages 0.3%
• CVE-2025-9162 Medium 4.9 Org.keycloak/keycloak-model-storage-service: variable injection into environment variables 0.5%
• CVE-2025-8419 Medium 5.3 Org.keycloak/keycloak-services: keycloak smtp inject vulnerability 0.6%
• CVE-2025-7365 High 7.1 Keycloak: phishing attack via email verification step in first login flow 0.3%
• CVE-2025-3910 Medium 5.4 Org.keycloak.authentication: two factor authentication bypass 0.4%
• CVE-2025-3501 High 8.2 Org.keycloak.protocol.services: keycloak hostname verification 0.5%
• CVE-2025-2559 Medium 4.9 Org.keycloak/keycloak-services: jwt token cache exhaustion leading to denial of service (dos) in keycloak 0.7%
• CVE-2025-1391 Medium 5.4 Keycloak-services: improper authorization in keycloak organization mapper allows unauthorized organization claims 0.5%
• CVE-2025-0604 Medium 5.4 Keycloak-ldap-federation: authentication bypass due to missing ldap bind after password reset in keycloak 0.7%
• CVE-2024-11736 Medium 4.9 Org.keycloak:keycloak-quarkus-server: unrestricted admin use of system and environment variables 0.8%
• CVE-2024-11734 Medium 6.5 Org.keycloak:keycloak-quarkus-server: denial of service in keycloak server via security headers 0.9%
• CVE-2024-10492 Low 2.7 Keycloak-quarkus-server: keycloak path trasversal 0.7%
• CVE-2024-10451 Medium 5.9 Org.keycloak:keycloak-quarkus-server: sensitive data exposure in keycloak build process 0.9%
• CVE-2024-10270 Medium 6.5 Org.keycloak:keycloak-services: keycloak denial of service 1.2%
• CVE-2024-9666 Medium 4.7 Org.keycloak/keycloak-quarkus-server: keycloak proxy header handling denial-of-service (dos) vulnerability 0.4%