Red Hat Red Hat build of Keycloak 26.2

CVE-2026-7507 High 7.5 Org.keycloak/keycloak-services: session fixation in oidc login flow that can lead to account takeover 0.8%
CVE-2026-7504 High 8.1 Org.keycloak/keycloak-services: open redirect when using wildcard valid redirect uris in keycloak 0.5%
CVE-2026-7307 High 7.5 Keycloak: keycloak: denial of service via specially crafted saml input 0.9%
CVE-2026-4636 High 8.1 Keycloak: keycloak: uma policy bypass allows authenticated users to gain unauthorized access to victim-owned resources. 0.4%
CVE-2026-4634 High 7.5 Keycloak: keycloak: denial of service via excessive processing of openid connect scope parameters 0.6%
CVE-2026-4325 Medium 5.3 Keycloak: keycloak: replay of action tokens via improper handling of single-use entries 0.3%
CVE-2026-4282 High 7.4 Keycloak: keycloak: privilege escalation via forged authorization codes due to singleuseobjectprovider isolation flaw 0.4%
CVE-2026-3872 High 7.3 Keycloak: keycloak: information disclosure due to redirect_uri validation bypass 0.4%
CVE-2026-2603 High 8.1 Keycloak: keycloak: unauthorized authentication via disabled saml identity provider 0.5%
CVE-2026-2092 High 7.7 Keycloak-services: keycloak: unauthorized access via improper validation of encrypted saml assertions 0.4%
CVE-2026-3047 High 8.8 Org.keycloak.broker.saml: keycloak saml broker: authentication bypass due to disabled saml client completing idp-initiated login 0.5%
CVE-2025-12150 Low 3.1 Org.keycloak/keycloak-services: webauthn attestation statement verification bypass 0.2%
CVE-2025-14778 Medium 5.4 Keycloak: incorrect ownership checks in /uma-policy/ 0.3%
CVE-2026-1529 High 8.1 Org.keycloak.services.resources.organizations: keycloak: unauthorized organization registration via improper invitation token validation 0.5%
CVE-2025-11419 High 7.5 Keycloak: keycloak tls client-initiated renegotiation denial of service 0.7%
CVE-2025-13467 Medium 5.5 Org.keycloak.storage.ldap: keycloak: deserialization of untrusted data in ldap user federation 0.5%
CVE-2025-12390 Medium 6.0 Org.keycloak.protocol.oidc.endpoints.logoutendpoint: offline session takeover due to reused authentication session id 0.1%
CVE-2025-12110 Medium 5.4 Keycloak: org.keycloak:keycloak-services: user can refresh offline session even after client's offline_access scope was removed 0.3%
CVE-2025-11429 Medium 5.4 Keycloak-server: too long and not settings compliant session 0.2%
CVE-2025-10044 Medium 4.3 Keycloak: keycloak error_description injection on error pages 0.3%
CVE-2025-9162 Medium 4.9 Org.keycloak/keycloak-model-storage-service: variable injection into environment variables 0.5%
CVE-2025-8419 Medium 5.3 Org.keycloak/keycloak-services: keycloak smtp inject vulnerability 0.6%
CVE-2025-7784 Medium 6.5 Org.keycloak/keycloak-services: privilege escalation in keycloak admin console (fgapv2 enabled) 0.5%
CVE-2025-7365 High 7.1 Keycloak: phishing attack via email verification step in first login flow 0.3%
CVE-2025-3501 High 8.2 Org.keycloak.protocol.services: keycloak hostname verification 0.5%
CVE-2024-12397 High 7.4 Io.quarkus.http/quarkus-http-core: quarkus http cookie smuggling 0.9%