Red Hat Red Hat build of Keycloak 26.4.13

• CVE-2026-9083 Medium 4.9 Keycloak: keycloak: information disclosure through arbitrary filesystem path probing 0.8%
• CVE-2026-9799 Medium 4.6 Keycloak: keycloak: unauthorized access to resources via uma permission ticket bypass 0.3%
• CVE-2026-9705 Medium 6.5 Keycloak: keycloak: attacker can re-enable and take over disabled clients via registration access token 0.5%
• CVE-2026-9086 High 7.3 Keycloak: keycloak: cross-site scripting (xss) via case-insensitive uri validation bypass 0.8%
• CVE-2026-9099 High 7.7 Keycloak: group-admin escalation to realm-admin 0.5%
• CVE-2026-9800 High 8.1 Keycloak-policy-enforcer: keycloak policy enforcer: authorization bypass via incorrect uri comparison 0.7%
• CVE-2026-9088 Low 2.7 Keycloak: keycloak: information disclosure due to user profile permission bypass 0.3%
• CVE-2026-9802 Medium 6.8 Keycloak: keycloak: unauthorized account access via replayed refresh tokens after cluster restart 0.3%
• CVE-2026-9803 Medium 5.3 Keycloak: keycloak: denial of service via malformed authorization header 0.4%
• CVE-2026-9801 Medium 4.9 Keycloak: keycloak: denial of service via malformed ldap password policy response 0.5%
• CVE-2026-9795 High 7.3 Keycloak: keycloak: privilege escalation via improper scope mapping enforcement 0.4%
• CVE-2026-9794 Medium 5.3 Keycloak: keycloak: information disclosure via saml ecp endpoint 0.4%
• CVE-2026-9792 Medium 6.5 Keycloak: keycloak: security restriction bypass allows unauthorized ropc token acquisition 0.3%
• CVE-2026-9791 Medium 4.3 Keycloak-rhel9: organization data leak after feature disabled in keycloak 0.2%
• CVE-2026-9704 Medium 6.8 Keycloak: keycloak: privilege escalation due to oversized subject_token jwt 0.3%
• CVE-2026-9087 Medium 6.4 Keycloak: cross-session email verification proof not bound to upstream identity in first-broker-login 0.3%
• CVE-2026-8922 Medium 5.4 Org.keycloak/keycloak-services: keycloak: org.keycloak.protocol.oidc: security flaw in org.keycloak/keycloak-services 0.3%
• CVE-2026-8830 Medium 4.3 Keycloak: org.keycloak/keycloak-services: keycloak: policy bypass during webauthn credential registration via client-side javascript manipulation 0.4%
• CVE-2026-7500 Medium 5.4 Org.keycloak.keycloak-services: improper access control on keycloak server when the account account api feature is disabled 0.2%
• CVE-2026-37977 Low 3.7 Keycloak: org.keycloak.protocol.oidc.grants.ciba: keycloak: information disclosure via cors header injection due to unvalidated jwt azp claim 0.3%
• CVE-2026-4874 Low 3.1 Org.keycloak.protocol.oidc.grants: org.keycloak.services.managers: keycloak: server-side request forgery via oidc token endpoint manipulation 0.4%