Vulnerabilities of Red Hat Red Hat Build of Keycloak

Is your version affected?

CVE list

CVE	Summary	Score	Published
CVE-2026-97847	Keycloak-services: keycloak-services: client manager can substitute sessionless token principal via hardcoded-claim mappers to obtain realm administrator authority	7.1 High	Nov 5, 2026
CVE-2026-97175	Keycloak-services: keycloak-services: unverified idp email auto-linking enables account takeover	8.8 High	Nov 5, 2026
CVE-2026-97174	Keycloak-services: keycloak-services: ciba sub parameter injection causes attacker authentication to issue victim tokens	6.8 Medium	Nov 5, 2026
CVE-2026-96453	Org.keycloak/keycloak-admin-cli: keycloak-admin-cli: kcadm custom truststore accepts arbitrary self-signed certificates	8.0 High	Nov 5, 2026
CVE-2026-93998	Keycloak-core: keycloak-core: saml adapter does not bind signed assertions to the configured identity provider issuer	7.4 High	Nov 5, 2026
CVE-2026-92857	Keycloak-services: keycloak-services: dcr protocol mapper config not validated, allowing iat holders to forge sub and aud claims in signed tokens	8.1 High	Nov 5, 2026
CVE-2026-92855	Keycloak-services: keycloak-services: saml broker accepts holder-of-key assertions without proof of key possession	7.4 High	Nov 5, 2026
CVE-2026-82965	Keycloak-services: keycloak-services: unauthenticated denial of service via saml soap endpoint unbounded xml parsing	7.5 High	Nov 5, 2026
CVE-2026-114232	Keycloak-services: keycloak-services: uma protection api resourcetype field not validated — cross-owner resource access	8.1 High	Nov 5, 2026
CVE-2026-112208	Keycloak-services: keycloak-services: account takeover via stale sso_auth note in organization identity-first login	8.1 High	Nov 5, 2026
CVE-2026-110932	Keycloak-services: keycloak-services: unauthenticated persistent disk exhaustion via theme gzip cache	7.5 High	Nov 5, 2026
CVE-2026-110931	Keycloak-services: keycloak-services: unauthenticated jvm termination via saml 1.1 authoritybinding parsing loop	7.5 High	Nov 5, 2026
CVE-2026-107602	Keycloak-services: keycloak-services: unauthenticated cpu exhaustion via saml 1.1 keyinfo infinite loop	7.5 High	Nov 5, 2026
CVE-2026-103112	Keycloak-services: keycloak-services: account takeover via authentication race using reset-credentials path	7.5 High	Nov 5, 2026
CVE-2026-107123	Keycloak-services: keycloak-services: unauthenticated cpu denial of service via saml xml datetime and duration parsing	7.5 High	Nov 5, 2026
CVE-2026-117691	Keycloak-services: keycloak-services: saml redirect binding signature bypass via percent-encoded parameter names	9.1 Critical	Nov 5, 2026
CVE-2026-107912	Io.quarkus/quarkus-vertx-http: quarkus-vertx-http: authorization bypass in management interface via path concatenation flaw	7.7 High	Nov 5, 2026
CVE-2026-120971	A flaw was found in RESTEasy's default exception mapper	5.3 Medium	Nov 3, 2026
CVE-2026-118959	A flaw was found in the required action provider mechanism of Keycloak	5.4 Medium	Oct 30, 2026
CVE-2026-118947	Keycloak-services: keycloak-services: authorization bypass via uma resource registration idor	4.3 Medium	Oct 30, 2026
CVE-2026-118425	A flaw was found in the secure-redirect-uris-enforcer client policy of Keycloak, an identity and access management…	6.8 Medium	Oct 29, 2026
CVE-2026-117859	A flaw was found in the Pushed Authorization Request PAR implementation of the keycloak-services component	5.4 Medium	Oct 29, 2026
CVE-2026-118030	A flaw was found in the HOTP authentication mechanism of the keycloak-services component, which provides identity and…	4.2 Medium	Oct 29, 2026
CVE-2026-117688	A flaw was found in the client registration component of Keycloak, an open-source identity and access management…	5.3 Medium	Oct 29, 2026
CVE-2026-117627	A flaw was found in the JWT Authorization Grant implementation of the keycloak-services component	5.4 Medium	Oct 29, 2026

1 2 3 4 5 6 … 10 11 Next →

Other Red Hat products