TI-2026-02223 CVE-2026-2603 · GHSA-x4p7-7chp-64hq
Keycloak: keycloak: unauthorized authentication via disabled saml identity provider
Priority HIGH 70
A flaw was found in Keycloak.
RHSA-2026:3947
Red Hat build of Keycloak 26.4.10 Update
Released 2026-03-05 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat build of Keycloak 26.4.10
Fixes 8 records
TI-2026-02631 CVE-2026-3047 · GHSA-8cr3-vpxx-92cx
Authentication bypass in Red Hat build of Keycloak 26.2
Priority MEDIUM 41
A flaw was found in org.keycloak.broker.saml.
TI-2026-02598 CVE-2026-3009 · GHSA-m297-3jv9-m927
Incorrect authorization in Red Hat build of Keycloak 26.4
Priority LOW 37
A security flaw in the IdentityBrokerService.performLogin endpoint of Keycloak allows authentication to proceed using an Identity Provider (IdP) even after it has been disabled by an administrator.
TI-2026-01746 CVE-2026-2092 · GHSA-794g-x443-36f7
Keycloak-services: keycloak: unauthorized access via improper validation of encrypted saml assertions
Priority LOW 34
A flaw was found in Keycloak.
TI-2026-02198 CVE-2026-2575 · GHSA-xv6h-r36f-3gp5
Keycloak: keycloak: denial of service due to excessive samlrequest decompression
Priority LOW 31
A flaw was found in Keycloak.
TI-2026-00498 CVE-2026-0707 · GHSA-gv94-wp4h-vv8p
Keycloak: keycloak authorization header parsing leading to potential security control bypass
Priority LOW 30
A flaw was found in Keycloak.
TI-2026-02339 CVE-2026-2733 · GHSA-fjf4-6f34-w64q
Org.keycloak/keycloak-services: keycloak: missing check on disabled client for docker registry protocol
Priority LOW 18
A flaw was identified in the Docker v2 authentication endpoint of Keycloak, where tokens continue to be issued even after a Docker registry client has been administratively disabled.
TI-2026-00917 CVE-2026-1190 · GHSA-63v5-26vq-m4vm
Improper signature verification in Red Hat build of Keycloak 26.4
Priority LOW 15
A flaw was found in Keycloak's SAML brokering functionality.