Red Hat Security Advisory

RHSA-2026:25097

Red Hat build of Keycloak 26.6.3 Images Update

Released 2026-06-10 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat build of Keycloak 26.6 rhbk/keycloak-operator-bundle, rhbk/keycloak-rhel9, rhbk/keycloak-rhel9-operator

Fixes 14 records

TI-2026-08505 CVE-2026-9704 · GHSA-rr5q-3xwr-f323

Keycloak: keycloak: privilege escalation due to oversized subject_token jwt

MEDIUM 40

A flaw was found in Keycloak.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.0032 Published 2026-05-27 Fixed in 26.4.13-1, 26.4-19 +3 CWE-1284

TI-2026-07984 CVE-2026-9087 · GHSA-m6qj-3mpp-57v8

Keycloak: cross-session email verification proof not bound to upstream identity in first-broker-login

LOW 37

A flaw was found in Keycloak.

CVSS 3.1HIGH 8.1 Network No auth User interaction EPSS 0.00312 Published 2026-05-20 Fixed in 26.4.13-1, 26.4-19 +3 CWE-639

TI-2026-08581 CVE-2026-9792 · GHSA-33j3-g875-37rp

Keycloak: keycloak: security restriction bypass allows unauthorized ropc token acquisition

LOW 34

A flaw was found in Keycloak's Client Policies, specifically within the `org.keycloak.protocol.oidc` component.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00268 Published 2026-05-28 Fixed in 26.4.13-1, 26.4-19 +3 CWE-280

TI-2026-08590 CVE-2026-9802 · GHSA-v5g5-wwmp-jppw

Keycloak: keycloak: unauthorized account access via replayed refresh tokens after cluster restart

LOW 32

A flaw was found in Keycloak.

CVSS 3.1MEDIUM 6.8 Network No auth User interaction EPSS 0.003 Published 2026-05-28 Fixed in 26.4.13-1, 26.4-19 +3 CWE-613

TI-2026-08591 CVE-2026-9803 · GHSA-cpf7-j4cf-vqx4

Keycloak: keycloak: denial of service via malformed authorization header

LOW 30

A flaw was found in Keycloak's ClientRegistrationAuth component.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00417 Published 2026-05-28 Fixed in 26.4.13-1, 26.4-19 +3 CWE-125

TI-2026-08583 CVE-2026-9794 · GHSA-fqjh-8322-vgrv

Keycloak: keycloak: information disclosure via saml ecp endpoint

LOW 30

A flaw was found in Keycloak.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00436 Published 2026-05-28 Fixed in 26.4.13-1, 26.4-19 +3 CWE-209

TI-2026-28102 CVE-2026-37977 · GHSA-5v8v-xvjv-57x7

Origin validation error in Red Hat build of Keycloak 26.4

LOW 24

A flaw was found in Keycloak.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00258 Published 2026-04-06 Fixed in 26.4.13-1, 26.4-19 +4 CWE-346

TI-2026-07843 CVE-2026-8922 · GHSA-83c4-ffjp-mxp9

Org.keycloak/keycloak-services: keycloak: org.keycloak.protocol.oidc: security flaw in org.keycloak/keycloak-services

LOW 24

A flaw was found in Keycloak.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00281 Published 2026-05-19 Fixed in 26.4.13-1, 26.4-19 +2 CWE-303

TI-2026-06590 CVE-2026-7500 · GHSA-hm32-hfmw-rhvg

Org.keycloak.keycloak-services: improper access control on keycloak server when the…

LOW 24

When Keycloak is started with `--features-disabled=account,account-api`, the Account REST API is only partially disabled.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00232 Published 2026-04-30 Fixed in 26.4.13-1, 26.4-19 +2 CWE-425

TI-2026-08589 CVE-2026-9801 · GHSA-f6r7-6w34-x2gp

Keycloak: keycloak: denial of service via malformed ldap password policy response

LOW 23

A flaw was found in Keycloak.

CVSS 3.1MEDIUM 4.9 Network High privileges No interaction EPSS 0.00477 Published 2026-05-28 Fixed in 26.4.13-1, 26.4-19 +3 CWE-1284

TI-2026-07754 CVE-2026-8830 · GHSA-g8vr-x4qh-25qg

Keycloak: org.keycloak/keycloak-services: keycloak: policy bypass during webauthn…

LOW 20

A flaw was found in Keycloak.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00392 Published 2026-05-19 Fixed in 26.4.13-1, 26.4-19 +3 CWE-603

TI-2026-08580 CVE-2026-9791 · GHSA-4q93-v92x-p89f

Keycloak-rhel9: organization data leak after feature disabled in keycloak

LOW 19

A flaw was found in Keycloak.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00215 Published 2026-05-28 Fixed in 26.4.13-1, 26.4-19 +3 CWE-863

TI-2026-04248 CVE-2026-4874 · GHSA-22rm-wp4x-v5cx

Server-side request forgery in Red Hat build of Keycloak 26.4

LOW 15

A flaw was found in Keycloak.

CVSS 3.1LOW 3.1 Network Low privileges No interaction EPSS 0.00353 Published 2026-03-26 Partial fix · 26.4.13-1, 26.4-19 +4 CWE-918

TI-2026-07985 CVE-2026-9088 · GHSA-6g26-7cx5-mrrg

Keycloak: keycloak: information disclosure due to user profile permission bypass

LOW 14

A flaw was found in org.keycloak.services.

CVSS 3.1LOW 2.7 Network High privileges No interaction EPSS 0.00348 Published 2026-06-05 Fixed in 26.4.13-1, 26.4-19 +3 CWE-1220