Known vulnerabilities in Red Hat build of Keycloak 26.6.8

Is your version affected?

CVE list

CVE	Summary	Score	Published
CVE-2026-97848	Keycloak-services: keycloak-services: protocol mapper with jsontype=json bypasses token sanitization	6.5 Medium	Nov 6, 2026
CVE-2026-97367	Keycloak-services: keycloak-services: dcr azp and sid claim substitution allows account rest session takeover	6.4 Medium	Nov 6, 2026
CVE-2026-96547	Keycloak-services: keycloak-services: dcr registration-time claim-path gap allows forging realm_access.roles	6.5 Medium	Nov 6, 2026
CVE-2026-96460	Keycloak-services: keycloak-services: indefinite access token renewal via standard token exchange v2	5.4 Medium	Nov 6, 2026
CVE-2026-19688	Keycloak-services: keycloak-services: admin api missing audience check	6.8 Medium	Nov 6, 2026
CVE-2026-92856	Keycloak-services: keycloak-services: saml broker ignores proxyrestriction delegation constraints	4.9 Medium	Nov 6, 2026
CVE-2026-96447	Keycloak-services: keycloak-services: stateless token preferred_username fallback enables identity rebinding	4.2 Medium	Nov 6, 2026
CVE-2026-109081	Keycloak-services: keycloak-services: injection of roles into realm default-roles via dcr endpoint	6.8 Medium	Nov 6, 2026
CVE-2026-107124	Keycloak-services: keycloak-services: oidc logout endpoint session fixation via id_token_hint leading to account takeover	6.4 Medium	Nov 6, 2026
CVE-2026-97847	Keycloak-services: keycloak-services: client manager can substitute sessionless token principal via hardcoded-claim mappers to obtain realm administrator authority	7.1 High	Nov 5, 2026
CVE-2026-97175	Keycloak-services: keycloak-services: unverified idp email auto-linking enables account takeover	8.8 High	Nov 5, 2026
CVE-2026-97174	Keycloak-services: keycloak-services: ciba sub parameter injection causes attacker authentication to issue victim tokens	6.8 Medium	Nov 5, 2026
CVE-2026-96453	Org.keycloak/keycloak-admin-cli: keycloak-admin-cli: kcadm custom truststore accepts arbitrary self-signed certificates	8.0 High	Nov 5, 2026
CVE-2026-93998	Keycloak-core: keycloak-core: saml adapter does not bind signed assertions to the configured identity provider issuer	7.4 High	Nov 5, 2026
CVE-2026-92857	Keycloak-services: keycloak-services: dcr protocol mapper config not validated, allowing iat holders to forge sub and aud claims in signed tokens	8.1 High	Nov 5, 2026
CVE-2026-92855	Keycloak-services: keycloak-services: saml broker accepts holder-of-key assertions without proof of key possession	7.4 High	Nov 5, 2026
CVE-2026-82965	Keycloak-services: keycloak-services: unauthenticated denial of service via saml soap endpoint unbounded xml parsing	7.5 High	Nov 5, 2026
CVE-2026-114232	Keycloak-services: keycloak-services: uma protection api resourcetype field not validated — cross-owner resource access	8.1 High	Nov 5, 2026
CVE-2026-112208	Keycloak-services: keycloak-services: account takeover via stale sso_auth note in organization identity-first login	8.1 High	Nov 5, 2026
CVE-2026-110932	Keycloak-services: keycloak-services: unauthenticated persistent disk exhaustion via theme gzip cache	7.5 High	Nov 5, 2026
CVE-2026-110931	Keycloak-services: keycloak-services: unauthenticated jvm termination via saml 1.1 authoritybinding parsing loop	7.5 High	Nov 5, 2026
CVE-2026-107602	Keycloak-services: keycloak-services: unauthenticated cpu exhaustion via saml 1.1 keyinfo infinite loop	7.5 High	Nov 5, 2026
CVE-2026-103112	Keycloak-services: keycloak-services: account takeover via authentication race using reset-credentials path	7.5 High	Nov 5, 2026
CVE-2026-107123	Keycloak-services: keycloak-services: unauthenticated cpu denial of service via saml xml datetime and duration parsing	7.5 High	Nov 5, 2026
CVE-2026-107889	Keycloak-services: keycloak-services: stored xss on login page via kcsanitize bypass	5.5 Medium	Oct 9, 2026

Other Red Hat products