Red Hat Red Hat build of Keycloak 26.6.6

• CVE-2026-15571 High 7.3 Keycloak-services: keycloak-services: predictable account-linking hash enables account takeover via malicious oidc client 0.4%
• CVE-2026-18963 Critical 9.1 Keycloak-services: keycloak-services: unauthenticated account takeover via reset-credentials flow bypass 4.7%
• CVE-2026-17048 Medium 5.5 Keycloak-services: keycloak-services: vault-resolved rotated client secrets leaked via admin rest api 0.4%
• CVE-2026-14613 Medium 4.3 Keycloak-services: keycloak-services: keycloak: fgap v2 role groups endpoint discloses hidden group metadata without group view permission 0.4%
• CVE-2026-9796 Medium 6.5 Keycloak: keycloak: privilege escalation via time-of-check to time-of-use (toctou) vulnerability 0.2%