Veille CVE

Recherche « Red Hat build of Keycloak 26.4 »

53 CVE

Critique 3 Élevée 19 Moyenne 27 Faible 4 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « Red Hat build of Keycloak 26.4 » ✕
  1. CVE-2026-19607 5.3 Moyenne

    Red Hat build of Keycloak 26.4 · Red Hat build of Keycloak 26.4.16 · Red Hat build of Keycloak 26.6 · Red Hat build of Keycloak 26.6.7

    A flaw was found in the first-broker-login flow of the keycloak-services component. This component handles the initial authentication and account linking when a user logs in via an external identity provider. The issue allows an attacker to register a matching username on an external provider to trigger a collision in Keycloak, which results in the legitimate user being locked out of their account.

  2. CVE-2026-17526 7.2 Élevée

    Red Hat build of Keycloak 26.4 · Red Hat build of Keycloak 26.4.16 · Red Hat build of Keycloak 26.6 · Red Hat build of Keycloak 26.6.7

    Keycloak is an open-source identity and access management solution. A vulnerability was discovered where a user with the impersonation role can impersonate a realm administrator. This allows the attacker to gain full administrative control over the realm, including the ability to manage users, clients, and roles.

  3. CVE-2026-79651 7.5 Élevée

    Red Hat build of Keycloak 26.4 · Red Hat build of Keycloak 26.4.16 · Red Hat build of Keycloak 26.6 · Red Hat build of Keycloak 26.6.7

    A flaw was found in the theme localization endpoints of the keycloak-services component, which is the core service responsible for authentication flows and theme management in Keycloak. The issue occurs because the system accepts arbitrary locale tags from unauthenticated requests and stores them in a permanent in-memory cache without limits. An attacker can exploit this by sending a large number of unique locale tags, eventually causing the server to run out of memory and crash.

  4. CVE-2026-74909 8.1 Élevée

    Red Hat build of Keycloak 26.4 · Red Hat build of Keycloak 26.4.16 · Red Hat build of Keycloak 26.6 · Red Hat build of Keycloak 26.6.7

    Keycloak provides a policy enforcer to protect applications by matching incoming web requests against defined security policies. A flaw was found where the enforcer fails to correctly normalize web addresses that contain special encoded characters, such as those representing semicolons or directory traversal segments. An authenticated user can use these encoded characters to trick the enforcer into applying a less restrictive security policy than intended, potentially gaining unauthorized access to sensitive administrative or private application endpoints.

  5. CVE-2026-18212 7.5 Élevée

    Red Hat build of Keycloak 26.4 · Red Hat build of Keycloak 26.4.16 · Red Hat build of Keycloak 26.6 · Red Hat build of Keycloak 26.6.7

    A flaw was found in the SAML Redirect Binding implementation of Keycloak, an open-source identity and access management solution. The issue occurs because the custom DEFLATE compression and decompression helpers fail to release native zlib memory after use. An unauthenticated attacker can exploit this by sending repeated malformed SAML requests, leading to native memory exhaustion and a denial of service.

  6. CVE-2026-19729 4.9 Moyenne

    Red Hat build of Keycloak 26.4 · Red Hat build of Keycloak 26.4.16 · Red Hat build of Keycloak 26.6 · Red Hat build of Keycloak 26.6.7

    A flaw was found in the key provider component of the keycloak-services library, which is the core engine for the Red Hat Build of Keycloak. The issue occurs because a previous fix for path probing was incomplete, allowing a realm administrator to still submit arbitrary filesystem paths as keystore parameters. This can be used to determine the existence and readability of files on the server, potentially exposing sensitive system information.

  7. CVE-2026-18963 9.1 Critique

    Red Hat build of Keycloak 26.4 · Red Hat build of Keycloak 26.4.15 · Red Hat build of Keycloak 26.6 · Red Hat build of Keycloak 26.6.6

    A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak. The issue allows an unauthenticated attacker to force the password reset process for any user without needing to click the required email verification link. This can result in the attacker gaining full control over target user accounts by directly setting new credentials.

  8. CVE-2026-16442 9.8 Critique

    Red Hat build of Keycloak 26.4 · Red Hat build of Keycloak 26.4.14 · Red Hat build of Keycloak 26.6 · Red Hat build of Keycloak 26.6.5

    A flaw was found in the SAML broker component of Keycloak, which is used to manage identity federation and user authentication. The issue occurs because the IdP-initiated Single Sign-On endpoint fails to check if a provider is restricted to account linking only. This allows an attacker with control over a linked upstream identity to bypass login restrictions and gain full access to a local user account.

  9. CVE-2026-15572 8.8 Élevée

    Red Hat build of Keycloak 26.4 · Red Hat build of Keycloak 26.4.14 · Red Hat build of Keycloak 26.6 · Red Hat build of Keycloak 26.6.5

    A flaw was found in Keycloak's Dynamic Client Registration (DCR) security policy management. The "Allowed Protocol Mapper Types" policy, which restricts which types of data mappers a client can use, fails to re-validate the mapper type during a client update if the mapper's configuration remains unchanged. An attacker with client registration privileges can exploit this by first registering an allowed mapper type with a malicious configuration and then swapping it for a restricted, high-privilege mapper type (such as one that hardcodes administrative roles). This allows the attacker to gain full administrative access to the Keycloak realm.

  10. CVE-2026-16102 8.1 Élevée

    Red Hat build of Keycloak 26.4 · Red Hat build of Keycloak 26.4.14 · Red Hat build of Keycloak 26.6 · Red Hat build of Keycloak 26.6.5

    A flaw was found in the Dynamic Client Registration (DCR) component of Keycloak, an identity and access management solution. The default DCR policy fails to properly validate the claim path for User Property mappers, allowing them to write values to sensitive internal claim locations. An attacker with a standard user account and a limited Initial Access Token can exploit this to forge administrative roles in their access token. This allows the attacker to take over other clients, steal confidential secrets, and potentially gain full administrative control over the realm.

  11. CVE-2026-16071 5.4 Moyenne

    Red Hat build of Keycloak 26.4 · Red Hat build of Keycloak 26.4.14 · Red Hat build of Keycloak 26.6 · Red Hat build of Keycloak 26.6.5

    A flaw was found in the LDAP storage provider of Keycloak, which is used to federate user identities from external directories. The issue occurs when a delegated administrator performs a search using a specific LDAP entry Distinguished Name (DN). Due to missing validation, the system allows lookups for users located outside the configured search boundary, leading to the disclosure of account information from unauthorized parts of the directory and unintended importing of those users into local storage.

  12. CVE-2026-15573 8.1 Élevée

    Red Hat build of Keycloak 26.4 · Red Hat build of Keycloak 26.4.14 · Red Hat build of Keycloak 26.6 · Red Hat build of Keycloak 26.6.5

    A flaw was found in Keycloak's Authorization Services. The component responsible for matching request paths to security policies (PathMatcher) does not properly normalize URIs before comparison. By adding extra characters like a trailing slash or matrix parameters to a URL, an attacker can trick the system into applying a less restrictive security policy than intended. This allows an authenticated user to access administrative or restricted areas they should not have permission to see.

  13. CVE-2026-16443 9.1 Critique

    Red Hat build of Keycloak 26.4 · Red Hat build of Keycloak 26.4.14 · Red Hat build of Keycloak 26.6 · Red Hat build of Keycloak 26.6.5

    A flaw was found in the SAML metadata import functionality of the keycloak-services component, which is the core engine for identity brokering in Red Hat Build of Keycloak. When importing identity provider metadata that lacks specific usage attributes for keys, the system incorrectly disables signature validation for SAML responses even if a signing certificate is provided. This issue allows an unauthenticated attacker to forge a SAML response and gain unauthorized access to a user account by knowing their external identifier.

  14. CVE-2026-14615 2.7 Faible

    Red Hat build of Keycloak 26.4 · Red Hat build of Keycloak 26.4.14 · Red Hat build of Keycloak 26.6 · Red Hat build of Keycloak 26.6.5

    A flaw was found in the Fine-Grained Admin Permissions (FGAP) v2 implementation within Keycloak's administrative services. When FGAP v2 is enabled, the system fails to properly filter child groups based on the caller's specific permissions when requested through a parent group. This allows a delegated administrator to view details of child groups they are not authorized to access directly, including group names, paths, and custom attributes.

  15. CVE-2026-14614 5.4 Moyenne

    Red Hat build of Keycloak 26.4 · Red Hat build of Keycloak 26.4.14 · Red Hat build of Keycloak 26.6 · Red Hat build of Keycloak 26.6.5

    A flaw was found in the ClientResource component of Keycloak's admin services when Fine-Grained Admin Permissions (FGAP) v2 is enabled. This issue allows a delegated administrator, who should only have limited control over specific clients, to attach or remove hidden client scopes that they are not authorized to see or manage. As a result, an attacker could inject unauthorized data or permissions into the security tokens issued to end-users, potentially tricking other applications into granting higher levels of access than intended.

  16. CVE-2026-4629 6.5 Moyenne

    Red Hat build of Keycloak 26.4 · Red Hat build of Keycloak 26.4.14 · Red Hat build of Keycloak 26.6.5 · Redhat build of keycloak

    A flaw was found in Keycloak. A highly privileged user with `manage-clients` permission can exploit this vulnerability by injecting a hardcoded role mapper into any client. This action allows the user to bypass existing scope restrictions and inject the `realm-admin` role into generated tokens, resulting in privilege escalation and full administrative access to the realm.

  17. CVE-2026-14209 4.3 Moyenne

    Red Hat build of Keycloak 26.4 · Red Hat build of Keycloak 26.4.14 · Red Hat build of Keycloak 26.6 · Red Hat build of Keycloak 26.6.5

    A vulnerability was discovered in Keycloak's Admin UI extension that allows certain administrative users to bypass security restrictions. When Fine-Grained Admin Permissions (FGAPv2) are enabled, an administrator who should only be able to search for users (but not view their full details) can use a specific "brute-force-user" endpoint to access a user's full profile. This includes sensitive information and security metadata. The issue occurs because the system fails to check if the administrator has the required "view" permission for that specific user when using this particular search path.

  18. CVE-2026-9800 8.1 Élevée

    Red Hat build of Keycloak 26.4 · Red Hat build of Keycloak 26.4.13 · Red Hat build of Keycloak 26.4.14 · Red Hat build of Keycloak 26.6

    A flaw was found in Keycloak Policy Enforcer. This vulnerability allows any authenticated user to bypass all authorization policies, including role, scope, and User-Managed Access (UMA) permission checks. By including the configured access-denied page path within a request URL, either as a path segment or a query parameter, an attacker can gain unauthorized access to protected resources.

  19. CVE-2026-9799 4.6 Moyenne

    Red Hat build of Keycloak 26.4 · Red Hat build of Keycloak 26.4.13 · Red Hat build of Keycloak 26.6 · Red Hat build of Keycloak 26.6.4

    A flaw was found in org.keycloak.authorization. An authenticated user with a granted User-Managed Access (UMA) permission ticket for one resource can exploit this by using a specific permission request prefix to bypass per-resource access control. This allows the user to gain unauthorized access to all resources of that type within the same resource server, even if they do not have a ticket for those specific resources. This vulnerability requires the resource server to be configured in PERMISSIVE policy enforcement mode and affects typed resources with ownerManagedAccess enabled, where no explicit policy protects the resource type. The primary consequence is unauthorized information disclosure or modification of resources.

  20. CVE-2026-9705 6.5 Moyenne

    Red Hat build of Keycloak 26.4 · Red Hat build of Keycloak 26.4.13 · Red Hat build of Keycloak 26.6 · Red Hat build of Keycloak 26.6.4

    A flaw was found in Keycloak's client registration service. A remote attacker, possessing a previously issued Registration Access Token (RAT), could exploit this vulnerability to re-enable a client that an administrator had explicitly disabled. This bypasses security controls, allowing the attacker to reset the client's secret and potentially regain privileged API access. The primary impact includes unauthorized information disclosure and potential integrity compromise.

  21. CVE-2026-9099 7.7 Élevée

    Red Hat build of Keycloak 26.4 · Red Hat build of Keycloak 26.4.13 · Red Hat build of Keycloak 26.6 · Red Hat build of Keycloak 26.6.4

    A flaw was found in Keycloak. A missing authorization check in the GroupResource.addChild() endpoint within the Admin REST API allows an authenticated user with limited administrative privileges to reparent any existing group. When Fine-Grained Admin Permissions v2 (FGAPv2) is enabled, an attacker with management rights over a single low-privilege group can reparent a highly privileged group (such as one possessing the realm-admin role) under their managed group. Because group permissions follow a hierarchical structure, this action unauthorizedly grants the attacker management and password-reset capabilities over the members of the targeted privileged group. An attacker can exploit this to reset an administrator's password, compromise the account, and achieve a full realm takeover, leading to a complete compromise of confidentiality, integrity, and availability.

  22. CVE-2026-9086 7.3 Élevée

    Red Hat build of Keycloak 26.4 · Red Hat build of Keycloak 26.4.13 · Red Hat build of Keycloak 26.6 · Red Hat build of Keycloak 26.6.4

    A flaw was found in Keycloak. A remote attacker with administrative privileges, specifically those with `manage-client` permission or access to client registration endpoints, could bypass client Uniform Resource Identifier (URI) validation. This is achieved by registering a malicious client with a specially crafted redirect URI using a case-insensitive `javascript:` or `data:` scheme. This Cross-Site Scripting (XSS) vulnerability allows for arbitrary code execution in the Keycloak origin when a victim clicks the crafted link, such as in the logout flow or the Admin Console.

  23. CVE-2026-9083 4.9 Moyenne

    Red Hat build of Keycloak 26.4 · Red Hat build of Keycloak 26.4.13 · Red Hat build of Keycloak 26.6 · Red Hat build of Keycloak 26.6.4

    A flaw was found in Keycloak. A realm administrator with the "manage-realm" role can exploit this vulnerability by submitting an arbitrary filesystem path as a keystore parameter when creating a key provider component. This allows the administrator to probe arbitrary filesystem paths, determining which files exist and are readable by the Keycloak process. This information disclosure could be used to identify high-value targets for follow-on attacks.

  24. CVE-2026-54513 8.1 Élevée

    FasterXML jackson-databind · Red Hat Cryostat 4 on RHEL 9 · Red Hat AMQ Broker 7.13.6 · Red Hat AMQ Broker 7.14.1

    jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8, 2.21.4, and 3.1.4, BasicPolymorphicTypeValidator.Builder.allowIfSubTypeIsArray() allowlists any array type based only on clazz.isArray(), without validating the array's component (element) type against the configured allowlist. A PTV built with allowIfSubTypeIsArray() plus an explicit concrete-type allowlist therefore still permits EvilType[] even though EvilType is not allowlisted. When Jackson deserializes the elements and no per-element type IDs are present, it instantiates the component type directly with no further PTV check, bypassing the allowlist. This vulnerability is fixed in 2.18.8, 2.21.4, and 3.1.4.

  25. CVE-2026-9088 2.7 Faible

    Red Hat build of Keycloak 26.4 · Red Hat build of Keycloak 26.4.13 · Red Hat build of Keycloak 26.6 · Red Hat build of Keycloak 26.6.3

    A flaw was found in org.keycloak.services. An administrator with delegated access to read group memberships and users can bypass user profile permissions by accessing the group members endpoint. This allows the administrator to view user attributes that are explicitly configured to be denied, leading to information disclosure.

  26. CVE-2026-9803 5.3 Moyenne

    Red Hat build of Keycloak 26.4 · Red Hat build of Keycloak 26.4.13 · Red Hat build of Keycloak 26.6 · Red Hat build of Keycloak 26.6.3

    A flaw was found in Keycloak's ClientRegistrationAuth component. A remote unauthenticated attacker can exploit this vulnerability by sending a specially crafted POST request with a malformed 'Authorization: Bearer' header to any client registration endpoint. This can lead to an ArrayIndexOutOfBoundsException, causing the server to return an HTTP 500 error and resulting in a Denial of Service (DoS) for the affected service.

  27. CVE-2026-9802 6.8 Moyenne

    Red Hat build of Keycloak 26.4 · Red Hat build of Keycloak 26.4.13 · Red Hat build of Keycloak 26.6 · Red Hat build of Keycloak 26.6.3

    A flaw was found in Keycloak. When revokeRefreshToken=true is enabled and persistent session storage is in use, a server restart can reset internal timing mechanisms. This allows a remote attacker, who has previously captured a user's refresh token, to replay that token even after it has been revoked. Successful exploitation grants the attacker unauthorized access to the victim's account, potentially leading to information disclosure or privilege escalation.

  28. CVE-2026-9801 4.9 Moyenne

    Red Hat build of Keycloak 26.4 · Red Hat build of Keycloak 26.4.13 · Red Hat build of Keycloak 26.6 · Red Hat build of Keycloak 26.6.3

    A flaw was found in Keycloak. A remote attacker with high privileges, such as a realm administrator configuring a malicious Lightweight Directory Access Protocol (LDAP) server or an attacker compromising an upstream LDAP server, could exploit this vulnerability. By sending a malformed LDAP password policy response during a password authentication request, the attacker can trigger an OutOfMemoryError. This causes the Keycloak Java Virtual Machine (JVM) to terminate, leading to a denial of service (DoS) for all realms on the affected node.

  29. CVE-2026-9798 4.3 Moyenne

    Red Hat build of Keycloak 26.4 · Red Hat build of Keycloak 26.4.14 · Red Hat build of Keycloak 26.6 · Red Hat build of Keycloak 26.6.5

    A flaw was found in Keycloak, an open-source identity and access management solution. When a user account is temporarily locked due to repeated failed login attempts, an attacker with valid client credentials can exploit the Client-Initiated Backchannel Authentication (CIBA) flow to bypass this brute-force protection. This allows continued authentication attempts and token issuance even when the account should be locked, potentially enabling further unauthorized access attempts.

  30. CVE-2026-9795 7.3 Élevée

    Red Hat build of Keycloak 26.4 · Red Hat build of Keycloak 26.4.13 · Red Hat build of Keycloak 26.6 · Red Hat build of Keycloak 26.6.4

    A flaw was found in Keycloak's Fine-Grained Admin Permissions (FGAPv2) feature. An administrator with limited client management permissions can exploit this vulnerability to assign any realm role, including highly privileged roles, to a client's scope mapping. This bypasses intended security controls, allowing the injected role to be projected into a user's authentication token when they access the modified client. This could lead to unauthorized privilege escalation within the Keycloak realm.

  31. CVE-2026-9794 5.3 Moyenne

    Red Hat build of Keycloak 26.4 · Red Hat build of Keycloak 26.4.13 · Red Hat build of Keycloak 26.6 · Red Hat build of Keycloak 26.6.3

    A flaw was found in Keycloak. A remote, unauthenticated attacker can exploit this vulnerability by sending specially crafted SOAP requests to the SAML ECP (Security Assertion Markup Language Enhanced Client or Proxy) endpoint with varying client IDs. By observing distinct faultstrings in the responses, the attacker can determine the client's protocol type, leading to information disclosure.

  32. CVE-2026-9793 7.5 Élevée

    Red Hat build of Keycloak 26.4 · Red Hat build of Keycloak 26.4.14 · Red Hat build of Keycloak 26.6 · Red Hat build of Keycloak 26.6.5

    A flaw was found in Keycloak. When a JSON Web Encryption (JWE) encrypted request object is submitted, Keycloak may incorrectly process unsigned claims if the decrypted content is raw JSON, bypassing the configured signature policy. This allows a remote attacker to submit unauthorized claims, leading to a compromise of data integrity within the OpenID Connect (OIDC) authorization flow. While a redirect URI allowlist acts as a compensating control, this vulnerability violates OIDC Core and Financial-grade API (FAPI) signing requirements.

  33. CVE-2026-9792 6.5 Moyenne

    Red Hat build of Keycloak 26.4 · Red Hat build of Keycloak 26.4.13 · Red Hat build of Keycloak 26.6 · Red Hat build of Keycloak 26.6.3

    A flaw was found in Keycloak's Client Policies, specifically within the `org.keycloak.protocol.oidc` component. When certain condition providers (client-type, client-roles, client-attributes, client-scopes) are used to enforce security restrictions, the `reject-ropc-grant` executor is silently bypassed. This allows an unauthenticated remote attacker to obtain tokens via a Resource Owner Password Credentials (ROPC) grant, even when a policy is explicitly configured to block it. This bypass can lead to unauthorized access and information disclosure.

  34. CVE-2026-9791 4.3 Moyenne

    Red Hat build of Keycloak 26.4 · Red Hat build of Keycloak 26.4.13 · Red Hat build of Keycloak 26.6 · Red Hat build of Keycloak 26.6.3

    A flaw was found in Keycloak. An authenticated user with existing organization membership can exploit this flaw by accessing user-facing APIs, such as the account API or by requesting an OpenID Connect (OIDC) token with the 'organization' scope. This allows organization metadata to be disclosed in tokens, even after an administrator has explicitly disabled the Organizations feature, potentially leading to incorrect authorization decisions by resource servers.

  35. CVE-2026-9704 8.8 Élevée

    Red Hat build of Keycloak 26.4 · Red Hat build of Keycloak 26.4.13 · Red Hat build of Keycloak 26.6 · Red Hat build of Keycloak 26.6.3

    A flaw was found in Keycloak. An authenticated user with low privileges can exploit this vulnerability by sending an oversized subject_token JSON Web Token (JWT) to the TokenEndpoint. When the token exceeds a 4000-character limit, it is silently dropped, causing the system to fall back to client credentials. This allows the user to gain the permissions of the client's service account, leading to privilege escalation.

  36. CVE-2026-9689 4.2 Moyenne

    Red Hat build of Keycloak 26.4 · Red Hat build of Keycloak 26.4.14 · Red Hat build of Keycloak 26.6 · Red Hat build of Keycloak 26.6.5

    A flaw was found in Keycloak, an open-source identity and access management solution. When a client application is configured to accept broad redirect Uniform Resource Identifiers (URIs), a remote attacker can manipulate the authentication process by crafting a special web address. If a user clicks this link, the client application might incorrectly prioritize attacker-controlled information over legitimate data. This vulnerability, known as HTTP parameter pollution, could allow an attacker to bypass security measures or gain unauthorized access to resources.

  37. CVE-2026-9087 8.1 Élevée

    Red Hat build of Keycloak 26.4 · Red Hat build of Keycloak 26.4.13 · Red Hat build of Keycloak 26.6 · Red Hat build of Keycloak 26.6.3

    A flaw was found in Keycloak. The cross-session verification proof is keyed only by (local userId, idpAlias) and is not bound to the upstream identity that was actually verified, so a second upstream account on the same IdP can consume it and get linked to the victim's local account.

  38. CVE-2026-7571 7.1 Élevée

    Red Hat build of Keycloak 26.4 · Red Hat build of Keycloak 26.4.12 · Redhat build of keycloak

    A flaw was found in Keycloak. A low-privilege user, with knowledge of user credentials and client ID, can bypass a security control intended to disable the implicit flow in OpenID Connect (OIDC) clients. By manipulating client data during a session restart, an attacker can obtain an access token that should not be available. This vulnerability can also lead to the exposure of these access tokens in server logs, proxy logs, and HTTP Referrer headers, resulting in sensitive information disclosure.

  39. CVE-2026-7507 7.5 Élevée

    Red Hat build of Keycloak 26.2 · Red Hat build of Keycloak 26.2.16 · Red Hat build of Keycloak 26.4 · Red Hat build of Keycloak 26.4.12

    A session fixation vulnerability was found in Keycloak's login-actions endpoints. An unauthenticated attacker could exploit this flaw by pre-creating an authentication session and tricking a victim into visiting a maliciously crafted link. By leveraging the /login-actions/restart endpoint—which processes session handles without adequate CSRF protection or cookie ownership validation—an attacker can reset the authentication flow state. This causes Single Sign-On (SSO) to authenticate the victim transparently upon clicking the link, allowing the attacker to hijack the required-action form without needing the victim's credentials. A successful exploit could lead to complete account takeover, including highly privileged administrative accounts.

  40. CVE-2026-7504 8.1 Élevée

    Red Hat build of Keycloak 26.2 · Red Hat build of Keycloak 26.2.16 · Red Hat build of Keycloak 26.4 · Red Hat build of Keycloak 26.4.12

    A flaw was found in Keycloak's URL validation logic during redirect operations. By crafting a malicious request, an attacker could bypass validation to redirect users to unauthorized URLs, potentially leading to the exposure of sensitive information within the domain or facilitating further attacks. This vulnerability specifically affects Keycloak clients configured with a wildcard (*) in the "Valid Redirect URIs" field and requires user interaction to be successfully exploited. The issue stems from a discrepancy in how Keycloak and the underlying Java URI implementation handle the user-info component of a URL. If a malicious redirect URL is constructed using multiple @ characters in the user-info section, Java's URI parser fails to extract the user-info, leaving only the raw authority field. Consequently, Keycloak's validation check fails to detect the malformed user-info, falls back to a wildcard comparison, and incorrectly permits the malicious redirect.

  41. CVE-2026-7307 7.5 Élevée

    Red Hat build of Keycloak 26.2 · Red Hat build of Keycloak 26.2.16 · Red Hat build of Keycloak 26.4 · Red Hat build of Keycloak 26.4.12

    A flaw was found in Keycloak. A remote, unauthenticated attacker can send a specially crafted XML input to the Security Assertion Markup Language (SAML) endpoint. This malicious input can cause high CPU usage and worker thread starvation, leading to a Denial of Service (DoS) where the server becomes unavailable.

  42. CVE-2026-4630 6.8 Moyenne

    Red Hat build of Keycloak 26.4 · Red Hat build of Keycloak 26.4.12 · Redhat build of keycloak

    A flaw was found in Keycloak. An authenticated client could exploit an Insecure Direct Object Reference (IDOR) vulnerability in the Authorization Services Protection API endpoint. By knowing or obtaining a resource's unique identifier (UUID) belonging to another Resource Server within the same realm, the client could bypass authorization checks. This allows the client to perform unauthorized GET, PUT, and DELETE operations on resources, leading to information disclosure and potential unauthorized modification or deletion of data.

  43. CVE-2026-37982 6.8 Moyenne

    Red Hat build of Keycloak 26.4 · Red Hat build of Keycloak 26.4.12 · Redhat build of keycloak

    A flaw was found in Keycloak. This authentication vulnerability allows a remote attacker to replay `ExecuteActionsActionToken` tokens within Keycloak's WebAuthn (Web Authentication) flow. By intercepting an execute-actions email link, an attacker can register their own authenticator to a victim's account. This leads to unauthorized enrollment of a hardware-backed credential, enabling persistent account takeover.

  44. CVE-2026-37981 4.3 Moyenne

    Red Hat build of Keycloak 26.4 · Red Hat build of Keycloak 26.4.12 · Redhat build of keycloak

    A flaw was found in Keycloak. A broken access control vulnerability in the Account Resources user lookup endpoint allows a remote authenticated user, who owns at least one User-Managed Access (UMA) resource, to enumerate and harvest personally identifiable information (PII) for all realm users. By sending crafted requests with arbitrary usernames or email values, the endpoint returns full profile objects for unrelated users. This leads to broad profile-level information disclosure.

  45. CVE-2026-37979 6.5 Moyenne

    Red Hat build of Keycloak 26.4 · Red Hat build of Keycloak 26.4.12 · Redhat build of keycloak

    A flaw was found in Keycloak. This access control vulnerability in Keycloak's OpenID Connect (OIDC) token introspection endpoint allows a confidential client to bypass audience restrictions. An attacker-controlled client with valid credentials can retrieve sensitive token claims intended for other resource servers, compromising the confidentiality of lightweight access tokens. This issue can be exploited remotely by any confidential client in the realm with valid credentials.

  46. CVE-2026-37978 4.9 Moyenne

    Red Hat build of Keycloak 26.4 · Red Hat build of Keycloak 26.4.12 · Redhat build of keycloak

    A flaw was found in Keycloak. A low-privilege administrator with the 'view-clients' role can exploit this by invoking the 'evaluate-scopes' Admin API endpoints with an arbitrary user ID (userId) parameter. This vulnerability allows for cross-role personally identifiable information (PII) leakage, enabling unauthorized visibility into user identities and authorizations across the realm. Exploitation is possible remotely via network access to the Admin API.

  47. CVE-2026-8922 5.4 Moyenne

    Red Hat build of Keycloak 26.4 · Red Hat build of Keycloak 26.4.13 · Red Hat build of Keycloak 26.6 · Red Hat build of Keycloak 26.6.3

    A flaw was found in Keycloak. When both realm-level and client-level `notBefore` revocation policies are configured, Keycloak's OpenID Connect (OIDC) Introspection feature fails to properly honor the realm-level policy. This allows tokens that should have been revoked to remain active, potentially leading to unauthorized access or continued session validity. This could impact the security of systems utilizing Keycloak for identity and access management.

  48. CVE-2026-8830 4.3 Moyenne

    Red Hat build of Keycloak 26.4 · Red Hat build of Keycloak 26.4.13 · Red Hat build of Keycloak 26.6 · Red Hat build of Keycloak 26.6.3

    A flaw was found in Keycloak. An authenticated user can bypass configured WebAuthn policies during credential registration by manipulating client-side JavaScript. This occurs because the server-side processAction() fails to validate that the newly created credential's parameters, such as public key algorithms, match the realm's configured WebAuthn policies. This could lead to the creation of credentials that do not adhere to administrative security requirements, potentially weakening the overall security posture of the system by allowing non-compliant authentication methods.

  49. CVE-2026-7500 5.4 Moyenne

    Red Hat build of Keycloak 26.4 · Red Hat build of Keycloak 26.4.13 · Red Hat build of Keycloak 26.6 · Red Hat build of Keycloak 26.6.3

    When Keycloak is started with `--features-disabled=account,account-api`, the Account REST API is only partially disabled. Five endpoints under the versioned path `/account/v1alpha1` remain fully functional — including both read and write operations — because they lack the `checkAccountApiEnabled()` gate that correctly blocks four other endpoints in the same REST service class. The user needs to have permissions to use the API.

  50. CVE-2026-37980 4.8 Moyenne

    Red Hat build of Keycloak 26.4.12 · Red Hat Build of Keycloak · Redhat build of keycloak

    A flaw was found in Keycloak, specifically in the organization selection login page. A remote attacker with `manage-realm` or `manage-organizations` administrative privileges can exploit a Stored Cross-Site Scripting (XSS) vulnerability. This flaw occurs because the `organization.alias` is placed into an inline JavaScript `onclick` handler, allowing a crafted JavaScript payload to execute in a user's browser when they view the login page. Successful exploitation enables arbitrary JavaScript execution, potentially leading to session theft, unauthorized account actions, or further attacks against users of the affected realm.

  51. CVE-2026-4633 3.7 Faible

    Red Hat build of Keycloak 26.4.12 · Red Hat Build of Keycloak · Redhat build of keycloak

    A flaw was found in Keycloak. A remote attacker can exploit differential error messages during the identity-first login flow when Organizations are enabled. This vulnerability allows an attacker to determine the existence of users, leading to information disclosure through user enumeration.

  52. CVE-2026-4628 4.3 Moyenne

    Red Hat build of Keycloak 26.4.12 · Red Hat Build of Keycloak · Red Hat JBoss Enterprise Application Platform 8 · Red Hat JBoss Enterprise Application Platform Expansion Pack

    A flaw was found in Keycloak. An improper Access Control vulnerability in Keycloak’s User-Managed Access (UMA) resource_set endpoint allows attackers with valid credentials to bypass the allowRemoteResourceManagement=false restriction. This occurs due to incomplete enforcement of access control checks on PUT operations to the resource_set endpoint. This issue enables unauthorized modification of protected resources, impacting data integrity.

  53. CVE-2026-0976 3.7 Faible

    Red Hat build of Keycloak 26.4.9 · Red Hat Build of Keycloak · Red Hat JBoss Enterprise Application Platform 8 · Red Hat JBoss Enterprise Application Platform Expansion Pack

    A flaw was found in Keycloak. This improper input validation vulnerability occurs because Keycloak accepts RFC-compliant matrix parameters in URL path segments, while common reverse proxy configurations may ignore or mishandle them. A remote attacker can craft requests to mask path segments, potentially bypassing proxy-level path filtering. This could expose administrative or sensitive endpoints that operators believe are not externally reachable.