Red Hat Security Advisory

RHSA-2026:19597

Red Hat build of Keycloak 26.4.12 Images Security Update

Released 2026-05-20 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat build of Keycloak 26.4 rhbk/keycloak-operator-bundle, rhbk/keycloak-rhel9, rhbk/keycloak-rhel9-operator

Fixes 10 records

TI-2026-06414 CVE-2026-7307 · GHSA-p5mv-gj8j-xqgf

Keycloak: keycloak: denial of service via specially crafted saml input

MEDIUM 40

A flaw was found in Keycloak.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00878 Published 2026-05-19 Fixed in 26.2.16, 26.4.12 +9 CWE-1286

TI-2026-06594 CVE-2026-7504 · GHSA-rp95-xpg9-c2cq

Org.keycloak/keycloak-services: open redirect when using wildcard valid redirect uris in keycloak

LOW 38

A flaw was found in Keycloak's URL validation logic during redirect operations.

CVSS 3.1HIGH 8.1 Network No auth User interaction EPSS 0.00637 Published 2026-05-19 Fixed in 26.2.16-1, 26.2-21 +3 CWE-601

TI-2026-06597 CVE-2026-7507 · GHSA-hf67-5vvq-fm3r

Org.keycloak/keycloak-services: session fixation in oidc login flow that can lead to account takeover

LOW 36

A session fixation vulnerability was found in Keycloak's login-actions endpoints.

CVSS 3.1HIGH 7.5 Network No auth User interaction EPSS 0.00836 Published 2026-05-19 Fixed in 26.2.16-1, 26.2-21 +7 CWE-290

TI-2026-04032 CVE-2026-4630 · GHSA-c739-f6xw-6pv2

Keycloak: keycloak: unauthorized resource access and data modification via insecure direct object reference

LOW 32

A flaw was found in Keycloak.

CVSS 3.1MEDIUM 6.8 Network Low privileges No interaction EPSS 0.00304 Published 2026-05-19 Fixed in 26.4.12-1, 26.4-17 +1 CWE-639

TI-2026-03802 CVE-2026-4366 · GHSA-g2qr-3mxm-86jj

Keycloak-services: blind server-side request forgery (ssrf) via http redirect handling in keycloak

LOW 32

A flaw was identified in Keycloak, an identity and access management solution, where it improperly follows HTTP redirects when processing certain client configuration requests.

CVSS 3.1MEDIUM 5.8 Network No auth No interaction EPSS 0.00242 Published 2026-03-18 Partial fix · 26.4.12-1, 26.4-17 CWE-918

TI-2026-06657 CVE-2026-7571 · GHSA-hq3p-w4xv-x7vp

Keycloak: keycloak: access token disclosure and implicit flow bypass via forged client data

LOW 31

A flaw was found in Keycloak.

CVSS 3.1HIGH 7.1 Network Low privileges No interaction EPSS 0.00415 Published 2026-05-19 Fixed in 26.4.12-1, 26.4-17 +1 CWE-472

TI-2026-28107 CVE-2026-37982 · GHSA-w4p5-rfh6-cwrv

Keycloak: org.keycloak.authentication: keycloak: unauthorized account takeover via webauthn token replay

LOW 30

A flaw was found in Keycloak.

CVSS 3.1MEDIUM 6.8 Network No auth User interaction EPSS 0.0044 Published 2026-05-19 Fixed in 26.4.12-1, 26.4-17 +1 CWE-294

TI-2026-28104 CVE-2026-37979 · GHSA-4x37-hw65-52w8

Keycloak: keycloak: information disclosure via oidc token introspection endpoint audience bypass

LOW 29

A flaw was found in Keycloak.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00366 Published 2026-05-19 Fixed in 26.4.12-1, 26.4-17 +1 CWE-639

TI-2026-28103 CVE-2026-37978 · GHSA-rrv7-3mqf-hxfr

Keycloak: org.keycloak.services: keycloak: information disclosure via evaluate-scopes admin api

LOW 23

A flaw was found in Keycloak.

CVSS 3.1MEDIUM 4.9 Network High privileges No interaction EPSS 0.00429 Published 2026-05-19 Fixed in 26.4.12-1, 26.4-17 +1 CWE-639

TI-2026-28106 CVE-2026-37981 · GHSA-933f-rg6j-f46p

Keycloak: org.keycloak.authorization: keycloak: information disclosure via broken access control in user lookup endpoint

LOW 20

A flaw was found in Keycloak.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.0037 Published 2026-05-19 Fixed in 26.4.12-1, 26.4-17 +2 CWE-1220