Vulnérabilités connues pour Red Hat build of Keycloak 26.6.8

Votre version est-elle touchée ?

Liste des CVE

CVE	Résumé	Score	Publiée
CVE-2026-107623	Keycloak-services: keycloak-services: oidc dcr read-modify-write silently disables offline token revocation	4.3 Moyenne	8 oct. 2026
CVE-2026-107121	Keycloak-services: keycloak-services: smtp starttls plaintext credential and message downgrade	6.5 Moyenne	7 oct. 2026
CVE-2026-105305	Keycloak-services: keycloak-services: device authorization grant bypasses per-client minimum.acr.value enforcement	5.4 Moyenne	6 oct. 2026
CVE-2026-103884	Keycloak-services: keycloak-services: path traversal in x.509 crl distribution point allows arbitrary local file read	6.5 Moyenne	1 oct. 2026
CVE-2026-101333	Keycloak-services: keycloak-services: unbounded metric series creation via idp tag on broker login endpoint	3.7 Faible	28 sept. 2026
CVE-2026-96448	Keycloak-services: keycloak-services: fgap v2 composite-blind role mapping allows privilege escalation	6.6 Moyenne	25 sept. 2026
CVE-2026-97846	Keycloak-services: keycloak-services: standard token exchange v2 bypasses mtls holder-of-key binding	6.8 Moyenne	25 sept. 2026
CVE-2026-97311	Keycloak-services: keycloak-services: admin rest api role-groups endpoint discloses groups without authorization	4.3 Moyenne	24 sept. 2026
CVE-2026-97177	Keycloak-services: keycloak-services: generic user update bypasses denied reset-password permission	6.6 Moyenne	24 sept. 2026
CVE-2026-96445	Keycloak-services: keycloak-services: conditional otp skip-header policy evaluated against untrusted proxy headers	6.8 Moyenne	23 sept. 2026
CVE-2026-96446	Keycloak-services: keycloak-services: par single-use bypass via prompt=none silent authentication path	4.2 Moyenne	23 sept. 2026
CVE-2026-95503	Keycloak-services: keycloak-services: potential kdc spoofing bypass when kerberos password authentication is enabled	6.8 Moyenne	22 sept. 2026
CVE-2026-94218	Keycloak-services: keycloak-services: 2fa setup enforcement bypass via authentication session restart endpoint	3.1 Faible	21 sept. 2026
CVE-2026-94217	Keycloak-services: keycloak-services: uma scope merge across resource owners via resource name collision	3.5 Faible	21 sept. 2026
CVE-2026-94215	Keycloak-services: keycloak-services: cross-realm client read/write via request-level cache missing realm ownership check	5.5 Moyenne	21 sept. 2026
CVE-2026-94213	Keycloak-services: keycloak-services: authorization services policy evaluation endpoint leaks user identity	4.9 Moyenne	21 sept. 2026
CVE-2026-94001	Keycloak-services: keycloak-services: admin credential delete bypasses denied reset-password permission	6.5 Moyenne	19 sept. 2026
CVE-2026-94000	Keycloak-services: keycloak-services: delegated admin with manage-users can escalate to realm-admin via group membership	6.6 Moyenne	19 sept. 2026
CVE-2026-93999	Keycloak-services: keycloak-services: token refresh continues issuing tokens for disabled audience clients	4.2 Moyenne	19 sept. 2026
CVE-2026-93562	Io.netty/netty-codec-http: netty: incomplete validation of malformed transfer-encoding allows http request smuggling	6.5 Moyenne	18 sept. 2026
CVE-2026-93574	Io.netty/netty-codec-http: netty: http request smuggling via post-digit whitespace in chunk-size parsing	6.5 Moyenne	18 sept. 2026
CVE-2026-93579	Io.netty/netty-codec-http2: netty: http/2 header field values are not validated by default (cr/lf/nul passthrough)	6.5 Moyenne	18 sept. 2026
CVE-2026-93573	Io.netty/netty-codec-http: netty split transfer-encoding fields bypass final-chunked validation and enable request smuggling	6.5 Moyenne	18 sept. 2026
CVE-2026-93568	Io.netty/netty-codec-http2: io.netty/netty-codec-http3: netty: http/2 and http/3 extended connect requests are downgraded as regular connect requests	7.5 Élevée	18 sept. 2026
CVE-2026-93569	Io.netty/netty-codec-http2: http/1 absolute-form host mismatch is translated to http/2 :authority, overriding the request-target authority	8.2 Élevée	18 sept. 2026

Autres produits Red Hat