Security
فارسی
All products

Red Hat JBoss Enterprise Application Platform Expansion Pack/keycloak-services

Red Hat · Package
10 reports
Vulnerability alerts
Follow
ReportProductEcosystemSeverityFix statusLast updated
Keycloak Server-Side Request Forgery via OIDC token endpoint manipulationCVE-2026-4874 · GHSA-22RM-WP4X-V5CX org.keycloak:keycloak-servicesRed Hat Build of Keycloak/rhbk/keycloak-operator-bundle MavenRed Hat Low Fix reported
Keycloak: Missing Check on Disabled Client for Docker Registry ProtocolCVE-2026-2733 · GHSA-FJF4-6F34-W64Q org.keycloak:keycloak-servicesRed Hat Build of Keycloak/rhbk/keycloak-operator-bundle MavenRed Hat Low No fix reported
Keycloak's missing timestamp validation allows attackers to extend SAML response validity periodsCVE-2026-1190 · GHSA-63V5-26VQ-M4VM org.keycloak:keycloak-servicesRed Hat JBoss Enterprise Application Platform 8/keycloak-services MavenRed Hat Low No fix reported
Keycloak: manage-clients permission escalates to full realm admin accessCVE-2026-3121 · GHSA-7XF9-4JFC-WGM4 org.keycloak:keycloak-servicesRed Hat JBoss Enterprise Application Platform 8/keycloak-services MavenRed Hat Medium Fix reported
Keycloak Server Private SPI: Improper Access Control Allows Administrators to Bypass Attribute Visibility Restrictions and Modify Unmanaged User Profile AttributesCVE-2026-0871 · GHSA-V4JW-M6RM-399H org.keycloak:keycloak-server-spi-privateRed Hat JBoss Enterprise Application Platform 8/keycloak-services MavenRed Hat Medium Fix reported
keycloak-services: Blind Server-Side Request Forgery (SSRF) via HTTP Redirect Handling in KeycloakCVE-2026-4366 Red Hat Build of Keycloak/rhbk/keycloak-operator-bundleRed Hat Build of Keycloak/rhbk/keycloak-rhel9-operator Red Hat Medium No fix reported
keycloak: keycloak: acceptable AAGUID policy bypass via packed self-attestation in WebAuthn registrationCVE-2026-6856 Red Hat Build of Keycloak/keycloak-servicesRed Hat Data Grid 8/keycloak-services Red Hat Low No fix reported
keycloak-services: keycloak-services: Group hierarchy search discloses hidden parent groups under FGAP v2CVE-2026-15945 Red Hat Data Grid 8/keycloak-servicesRed Hat JBoss Enterprise Application Platform Expansion Pack/keycloak-services Red Hat Medium No fix reported
keycloak-services: keycloak-services: Required signed-JWT assertion policy can be bypassed with unsigned assertion headersCVE-2026-16093 Red Hat Data Grid 8/keycloak-servicesRed Hat JBoss Enterprise Application Platform Expansion Pack/keycloak-services Red Hat Medium No fix reported
keycloak-services: keycloak-services: SAML OneTimeUse assertion replay in IdP-Initiated broker flowCVE-2026-18967 Red Hat Build of Keycloak/keycloak-servicesRed Hat Build of Keycloak/rhbk-keycloak-rhel9/rhbk-keycloak-rhel9 Red Hat Medium No fix reported