Red Hat Red Hat build of Keycloak 26.4

• CVE-2026-4634 High 7.5 Keycloak: keycloak: denial of service via excessive processing of openid connect scope parameters 0.6%
• CVE-2026-4325 Medium 5.3 Keycloak: keycloak: replay of action tokens via improper handling of single-use entries 0.3%
• CVE-2026-4282 High 7.4 Keycloak: keycloak: privilege escalation via forged authorization codes due to singleuseobjectprovider isolation flaw 0.4%
• CVE-2026-3872 High 7.3 Keycloak: keycloak: information disclosure due to redirect_uri validation bypass 0.4%
• CVE-2026-3121 Medium 6.5 Keycloak: org.keycloak/keycloak-services: keycloak: privilege escalation via manage-clients permission 0.5%
• CVE-2026-3190 Medium 4.3 Keycloak: keycloak: information disclosure via improper role enforcement in uma 2.0 protection api 0.3%
• CVE-2026-4874 Low 3.1 Org.keycloak.protocol.oidc.grants: org.keycloak.services.managers: keycloak: server-side request forgery via oidc token endpoint manipulation 0.4%
• CVE-2026-4366 Medium 5.8 Keycloak-services: blind server-side request forgery (ssrf) via http redirect handling in keycloak 0.2%
• CVE-2026-2575 Medium 5.3 Keycloak: keycloak: denial of service due to excessive samlrequest decompression 0.7%
• CVE-2026-2603 High 8.1 Keycloak: keycloak: unauthorized authentication via disabled saml identity provider 0.5%
• CVE-2026-2092 High 7.7 Keycloak-services: keycloak: unauthorized access via improper validation of encrypted saml assertions 0.4%
• CVE-2026-2366 Low 3.1 Keycloak: keycloak: information disclosure via authorization bypass in admin api 0.3%
• CVE-2026-3429 Medium 4.2 Org.keycloak.services.resources.account: improper access control leading to mfa deletion and account takeover in keycloak account rest api 0.3%
• CVE-2026-3911 Low 2.7 Org.keycloak.services.resources.admin.userresource: keycloak: information disclosure of disabled user attributes via administrative endpoint 0.4%
• CVE-2026-3047 High 8.8 Org.keycloak.broker.saml: keycloak saml broker: authentication bypass due to disabled saml client completing idp-initiated login 0.5%
• CVE-2026-3009 High 8.1 Org.keycloak/keycloak-services: improper enforcement of disabled identity provider in identitybrokerservice (authentication bypass) 0.4%
• CVE-2025-12150 Low 3.1 Org.keycloak/keycloak-services: webauthn attestation statement verification bypass 0.2%
• CVE-2026-0871 Medium 4.9 Org.keycloak/keycloak-services: keycloak: unauthorized modification of unmanaged user attributes by administrators 0.3%
• CVE-2026-2733 Low 3.8 Org.keycloak/keycloak-services: keycloak: missing check on disabled client for docker registry protocol 0.4%
• CVE-2025-14778 Medium 5.4 Keycloak: incorrect ownership checks in /uma-policy/ 0.3%
• CVE-2026-1529 High 8.1 Org.keycloak.services.resources.organizations: keycloak: unauthorized organization registration via improper invitation token validation 0.5%
• CVE-2026-1486 High 8.8 Org.keycloak.protocol.oidc.grants: disabled identity providers are still accepted for jwt authorization grant 0.5%
• CVE-2025-13881 Low 2.7 Org.keycloak.services.resources.admin: keycloak: limited administrator can retrieve sensitive user attributes via admin api 0.4%
• CVE-2026-1190 Low 3.1 Org.keycloak/keycloak-services: keycloak saml brokering: response delay due to unchecked notonorafter in subjectconfirmationdata 0.4%
• CVE-2025-14083 Low 2.7 Keycloak-server: keycloak: improper access control in admin rest api leads to information disclosure 0.4%
• CVE-2025-14559 Medium 6.5 Org.keycloak/keycloak-services: keycloak keycloak-services: business logic flaw allows unauthorized token issuance for disabled users 0.5%
• CVE-2026-1035 Low 3.1 Org.keycloak.protocol.oidc: keycloak refresh token reuse bypass via toctou race condition 0.3%
• CVE-2026-1180 Medium 5.8 Org.keycloak.protocol.oidc: blind server-side request forgery (ssrf) in keycloak oidc dynamic client registration via jwks_uri 0.4%
• CVE-2026-0707 Medium 5.3 Keycloak: keycloak authorization header parsing leading to potential security control bypass 0.4%
• CVE-2025-14777 Medium 6.0 Keycloak: keycloak idor in realm client creating/deleting 0.3%
• CVE-2025-14082 Low 2.7 Keycloak-services: keycloak admin rest api: improper access control leads to sensitive role metadata information disclosure 0.4%
• CVE-2025-13467 Medium 5.5 Org.keycloak.storage.ldap: keycloak: deserialization of untrusted data in ldap user federation 0.5%
• CVE-2025-11538 Medium 6.8 Keycloak-server: debug default bind address 0.4%
• CVE-2025-12390 Medium 6.0 Org.keycloak.protocol.oidc.endpoints.logoutendpoint: offline session takeover due to reused authentication session id 0.1%
• CVE-2025-10939 Low 3.7 Org.keycloak/keycloak-quarkus-server: unable to restrict access to the admin console 0.4%
• CVE-2025-12110 Medium 5.4 Keycloak: org.keycloak:keycloak-services: user can refresh offline session even after client's offline_access scope was removed 0.3%