Red Hat Security Advisory

RHSA-2026:19594

Red Hat build of Keycloak 26.2.16 Security Update

Released 2026-05-20 · Red Hat rating Important · View on Red Hat →

Fixed in

TI-2026-06414 CVE-2026-7307 · GHSA-p5mv-gj8j-xqgf

MEDIUM 40

A flaw was found in Keycloak.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00878 Published 2026-05-19 Fixed in 26.2.16, 26.4.12 +9 CWE-1286

TI-2026-06594 CVE-2026-7504 · GHSA-rp95-xpg9-c2cq

LOW 38

A flaw was found in Keycloak's URL validation logic during redirect operations.

CVSS 3.1HIGH 8.1 Network No auth User interaction EPSS 0.00637 Published 2026-05-19 Fixed in 26.2.16-1, 26.2-21 +3 CWE-601

TI-2026-06597 CVE-2026-7507 · GHSA-hf67-5vvq-fm3r

LOW 36

A session fixation vulnerability was found in Keycloak's login-actions endpoints.

CVSS 3.1HIGH 7.5 Network No auth User interaction EPSS 0.00836 Published 2026-05-19 Fixed in 26.2.16-1, 26.2-21 +7 CWE-290