Red Hat Security Advisory

RHSA-2025:22089

Red Hat build of Keycloak 26.2.11 Security Update

Released 2025-11-25 · Red Hat rating Moderate · View on Red Hat →

Fixed in

TI-2025-11367 CVE-2025-12390 · GHSA-rg35-5v25-mqvp

LOW 28

A flaw was found in Keycloak.

CVSS 3.1MEDIUM 6.0 Local Low privileges User interaction EPSS 0.00141 Published 2025-10-28 Fixed in 26.0.0, 26.2.11-1 +3 CWE-384

TI-2025-12311 CVE-2025-13467 · GHSA-4hx9-48xh-5mxr

LOW 25

A flaw was found in the Keycloak LDAP User Federation provider.

CVSS 3.1MEDIUM 5.5 Network High privileges No interaction EPSS 0.00472 Published 2025-11-25 Fixed in 26.4.6, 26.2.11-1 +5 CWE-502

TI-2025-11106 CVE-2025-12110 · GHSA-895x-rfqp-jh5c

LOW 24

A flaw was found in Keycloak.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00301 Published 2025-10-23 Fixed in 26.4.3, 26.2.11-1 +4 CWE-613

TI-2025-10469 CVE-2025-11429 · GHSA-64w3-5q9m-68xf

LOW 24

A flaw was found in Keycloak.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00235 Published 2025-10-23 Fixed in 26.4.1, 26.2.11-1 +2 CWE-613

TI-2025-11141 CVE-2025-12150 · GHSA-7g5x-9c4v-4w5r

LOW 15

A flaw was found in Keycloak’s WebAuthn registration component.

CVSS 3.1LOW 3.1 Network No auth User interaction EPSS 0.0023 Published 2026-02-27 Fixed in 26.4.4, 26.2.11-1 +3 CWE-347