Red Hat Red Hat build of Keycloak 26.4.11

CVE-2026-4636 High 8.1 Keycloak: keycloak: uma policy bypass allows authenticated users to gain unauthorized access to victim-owned resources. 0.4%
CVE-2026-4634 High 7.5 Keycloak: keycloak: denial of service via excessive processing of openid connect scope parameters 0.6%
CVE-2026-4325 Medium 5.3 Keycloak: keycloak: replay of action tokens via improper handling of single-use entries 0.3%
CVE-2026-4282 High 7.4 Keycloak: keycloak: privilege escalation via forged authorization codes due to singleuseobjectprovider isolation flaw 0.4%
CVE-2026-3872 High 7.3 Keycloak: keycloak: information disclosure due to redirect_uri validation bypass 0.4%
CVE-2026-3121 Medium 6.5 Keycloak: org.keycloak/keycloak-services: keycloak: privilege escalation via manage-clients permission 0.5%
CVE-2026-3190 Medium 4.3 Keycloak: keycloak: information disclosure via improper role enforcement in uma 2.0 protection api 0.3%
CVE-2026-2366 Low 3.1 Keycloak: keycloak: information disclosure via authorization bypass in admin api 0.3%
CVE-2026-3429 Medium 4.2 Org.keycloak.services.resources.account: improper access control leading to mfa deletion and account takeover in keycloak account rest api 0.3%
CVE-2026-3911 Low 2.7 Org.keycloak.services.resources.admin.userresource: keycloak: information disclosure of disabled user attributes via administrative endpoint 0.4%
CVE-2025-14083 Low 2.7 Keycloak-server: keycloak: improper access control in admin rest api leads to information disclosure 0.4%
CVE-2026-1035 Low 3.1 Org.keycloak.protocol.oidc: keycloak refresh token reuse bypass via toctou race condition 0.3%
CVE-2026-1180 Medium 5.8 Org.keycloak.protocol.oidc: blind server-side request forgery (ssrf) in keycloak oidc dynamic client registration via jwks_uri 0.4%
CVE-2025-14777 Medium 6.0 Keycloak: keycloak idor in realm client creating/deleting 0.3%
CVE-2025-14082 Low 2.7 Keycloak-services: keycloak admin rest api: improper access control leads to sensitive role metadata information disclosure 0.4%