Red Hat Red Hat build of Keycloak 26.6

• CVE-2026-11986 Medium 4.9 Keycloak-rest-admin-ui-ext: authorization bypass vulnerability in the admin-ui-ext bulk role-mapping-delete endpoints of keycloak 0.3%
• CVE-2026-9088 Low 2.7 Keycloak: keycloak: information disclosure due to user profile permission bypass 0.3%
• CVE-2026-9802 Medium 6.8 Keycloak: keycloak: unauthorized account access via replayed refresh tokens after cluster restart 0.3%
• CVE-2026-9803 Medium 5.3 Keycloak: keycloak: denial of service via malformed authorization header 0.4%
• CVE-2026-9801 Medium 4.9 Keycloak: keycloak: denial of service via malformed ldap password policy response 0.5%
• CVE-2026-9798 Medium 4.3 Keycloak: keycloak: brute-force protection bypass in ciba flow 0.4%
• CVE-2026-9796 Medium 6.5 Keycloak: keycloak: privilege escalation via time-of-check to time-of-use (toctou) vulnerability 0.2%
• CVE-2026-9795 High 7.3 Keycloak: keycloak: privilege escalation via improper scope mapping enforcement 0.4%
• CVE-2026-9794 Medium 5.3 Keycloak: keycloak: information disclosure via saml ecp endpoint 0.4%
• CVE-2026-9792 Medium 6.5 Keycloak: keycloak: security restriction bypass allows unauthorized ropc token acquisition 0.3%
• CVE-2026-9793 Medium 5.9 Keycloak: keycloak: security policy bypass in jwe-encrypted request object processing 0.2%
• CVE-2026-9791 Medium 4.3 Keycloak-rhel9: organization data leak after feature disabled in keycloak 0.2%
• CVE-2026-9704 Medium 6.8 Keycloak: keycloak: privilege escalation due to oversized subject_token jwt 0.3%
• CVE-2026-9689 Medium 4.2 Keycloak: org.keycloak.protocol.oidc: http parameter pollution in oidc redirect uri allows response parameter duplication - #ghi-604 0.3%
• CVE-2026-9087 Medium 6.4 Keycloak: cross-session email verification proof not bound to upstream identity in first-broker-login 0.3%
• CVE-2026-8922 Medium 5.4 Org.keycloak/keycloak-services: keycloak: org.keycloak.protocol.oidc: security flaw in org.keycloak/keycloak-services 0.3%
• CVE-2026-8830 Medium 4.3 Keycloak: org.keycloak/keycloak-services: keycloak: policy bypass during webauthn credential registration via client-side javascript manipulation 0.4%
• CVE-2026-7500 Medium 5.4 Org.keycloak.keycloak-services: improper access control on keycloak server when the account account api feature is disabled 0.2%
• CVE-2026-37977 Low 3.7 Keycloak: org.keycloak.protocol.oidc.grants.ciba: keycloak: information disclosure via cors header injection due to unvalidated jwt azp claim 0.3%
• CVE-2026-4874 Low 3.1 Org.keycloak.protocol.oidc.grants: org.keycloak.services.managers: keycloak: server-side request forgery via oidc token endpoint manipulation 0.4%