| Keycloak Server-Side Request Forgery via OIDC token endpoint manipulationCVE-2026-4874 · GHSA-22RM-WP4X-V5CX |
org.keycloak:keycloak-servicesRed Hat Build of Keycloak/rhbk/keycloak-operator-bundle |
MavenRed Hat |
Low
|
Fix reported |
|
| Keycloak: Missing Check on Disabled Client for Docker Registry ProtocolCVE-2026-2733 · GHSA-FJF4-6F34-W64Q |
org.keycloak:keycloak-servicesRed Hat Build of Keycloak/rhbk/keycloak-operator-bundle |
MavenRed Hat |
Low
|
No fix reported |
|
| org.keycloak:keycloak-services has Inefficient Regular Expression ComplexityCVE-2024-10270 · GHSA-WQ8X-CG39-8MRR |
org.keycloak:keycloak-servicesRed Hat Single Sign-On 7/keycloak-services |
MavenRed Hat |
High
|
Fix reported |
|
| Keycloak's missing timestamp validation allows attackers to extend SAML response validity periodsCVE-2026-1190 · GHSA-63V5-26VQ-M4VM |
org.keycloak:keycloak-servicesRed Hat JBoss Enterprise Application Platform 8/keycloak-services |
MavenRed Hat |
Low
|
No fix reported |
|
| Keycloak: Unauthenticated account takeover via reset-credentials flow bypassCVE-2026-18963 · GHSA-4GV3-MC9P-5WQC |
org.keycloak:keycloak-servicesRed Hat Single Sign-On 7/keycloak-services |
MavenRed Hat |
Critical
|
Fix reported |
|
| Keycloak allows authentication using an Identity Provider (IdP) even after it has been disabled by an administratorCVE-2026-3009 · GHSA-M297-3JV9-M927 |
org.keycloak:keycloak-servicesRed Hat Single Sign-On 7/keycloak-services |
MavenRed Hat |
High
|
Fix reported |
|
| Keycloak Server Private SPI: Improper Access Control Allows Administrators to Bypass Attribute Visibility Restrictions and Modify Unmanaged User Profile AttributesCVE-2026-0871 · GHSA-V4JW-M6RM-399H |
org.keycloak:keycloak-server-spi-privateRed Hat JBoss Enterprise Application Platform 8/keycloak-services |
MavenRed Hat |
Medium
|
Fix reported |
|
| Keycloak Denial of Service (DoS) Vulnerability via JWT Token CacheCVE-2025-2559 · GHSA-2935-2WFM-HHPV |
org.keycloak:keycloak-servicesRed Hat Single Sign-On 7/keycloak-services |
MavenRed Hat |
Medium
|
No fix reported |
|
| keycloak-services: keycloak-services: manage-clients to arbitrary code execution through inline JavaScript policy importCVE-2026-120984 |
Red Hat Build of Keycloak/keycloak-servicesRed Hat Build of Keycloak/rhbk/keycloak-rhel9 |
Red Hat |
High
|
No fix reported |
|
| keycloak-services: keycloak-services: OIDC logout endpoint session fixation via id_token_hint leading to account takeoverCVE-2026-107124 |
Red Hat Single Sign-On 7/keycloak-services |
Red Hat |
Medium
|
No fix reported |
|
| keycloak-services: keycloak-services: SAML broker ignores ProxyRestriction delegation constraintsCVE-2026-92856 |
Red Hat Single Sign-On 7/keycloak-services |
Red Hat |
Medium
|
No fix reported |
|
| keycloak-services: keycloak-services: SAML broker accepts holder-of-key assertions without proof of key possessionCVE-2026-92855 |
Red Hat Single Sign-On 7/keycloak-services |
Red Hat |
High
|
No fix reported |
|
| keycloak-services: keycloak-services: Unauthenticated Denial of Service via SAML SOAP endpoint unbounded XML parsingCVE-2026-82965 |
Red Hat Single Sign-On 7/keycloak-services |
Red Hat |
High
|
No fix reported |
|
| CVE-2026-103112CVE-2026-103112 |
Red Hat Single Sign-On 7/keycloak-services |
Red Hat |
High
|
No fix reported |
|
| keycloak-services: Blind Server-Side Request Forgery (SSRF) via HTTP Redirect Handling in KeycloakCVE-2026-4366 |
Red Hat Build of Keycloak/rhbk/keycloak-operator-bundleRed Hat Build of Keycloak/rhbk/keycloak-rhel9-operator |
Red Hat |
Medium
|
No fix reported |
|
| keycloak: keycloak: acceptable AAGUID policy bypass via packed self-attestation in WebAuthn registrationCVE-2026-6856 |
Red Hat Build of Keycloak/keycloak-servicesRed Hat Data Grid 8/keycloak-services |
Red Hat |
Low
|
No fix reported |
|
| keycloak: keycloak: privilege escalation via partialImport FGAP permission bypassCVE-2026-11577 |
Red Hat Build of Keycloak/keycloak-servicesRed Hat Single Sign-On 7/keycloak-services |
Red Hat |
High
|
No fix reported |
|
| keycloak-services: keycloak-services: Group hierarchy search discloses hidden parent groups under FGAP v2CVE-2026-15945 |
Red Hat Data Grid 8/keycloak-servicesRed Hat JBoss Enterprise Application Platform Expansion Pack/keycloak-services |
Red Hat |
Medium
|
No fix reported |
|
| keycloak-services: keycloak-services: Required signed-JWT assertion policy can be bypassed with unsigned assertion headersCVE-2026-16093 |
Red Hat Data Grid 8/keycloak-servicesRed Hat JBoss Enterprise Application Platform Expansion Pack/keycloak-services |
Red Hat |
Medium
|
No fix reported |
|
| keycloak-services: keycloak-services: Default DCR policy allows role forgery via User Property mappersCVE-2026-16102 |
Red Hat Single Sign-On 7/keycloak-services |
Red Hat |
High
|
No fix reported |
|
