Red Hat Red Hat build of Keycloak 26.4.12

• CVE-2026-7571 High 7.1 Keycloak: keycloak: access token disclosure and implicit flow bypass via forged client data 0.4%
• CVE-2026-7507 High 7.5 Org.keycloak/keycloak-services: session fixation in oidc login flow that can lead to account takeover 0.8%
• CVE-2026-7504 High 8.1 Org.keycloak/keycloak-services: open redirect when using wildcard valid redirect uris in keycloak 0.5%
• CVE-2026-37982 Medium 6.8 Keycloak: org.keycloak.authentication: keycloak: unauthorized account takeover via webauthn token replay 0.4%
• CVE-2026-37979 Medium 6.5 Keycloak: keycloak: information disclosure via oidc token introspection endpoint audience bypass 0.4%
• CVE-2026-37978 Medium 4.9 Keycloak: org.keycloak.services: keycloak: information disclosure via evaluate-scopes admin api 0.4%
• CVE-2026-7307 High 7.5 Keycloak: keycloak: denial of service via specially crafted saml input 0.9%
• CVE-2026-37981 Medium 4.3 Keycloak: org.keycloak.authorization: keycloak: information disclosure via broken access control in user lookup endpoint 0.4%
• CVE-2026-4630 Medium 6.8 Keycloak: keycloak: unauthorized resource access and data modification via insecure direct object reference 0.3%
• CVE-2026-37980 Medium 6.9 Org.keycloak.forms.login: keycloak: keycloak: arbitrary code execution via stored cross-site scripting (xss) in organization selection login page 0.4%
• CVE-2026-4633 Low 3.7 Keycloak: keycloak: user enumeration via differential error messages 0.4%
• CVE-2026-4628 Medium 4.3 Keycloak: org.keycloak.authorization: keycloak: unauthorized resource modification due to improper access control 0.3%
• CVE-2026-4366 Medium 5.8 Keycloak-services: blind server-side request forgery (ssrf) via http redirect handling in keycloak 0.2%