Advisories · Technology
Red Hat build of Keycloak 26.4.16.
Every CVE that names Red Hat build of Keycloak 26.4.16 among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 5.3 Medium
Keycloak-services: keycloak-services: broker-originated username collision causes account lockout
- Red Hat build of Keycloak 26.4
- Red Hat build of Keycloak 26.4.16
- Authentication bypass
- CVSS 7.2 High
Keycloak-services: keycloak-services: privilege escalation via impersonation role allows takeover of realm administrator accounts
- Red Hat build of Keycloak 26.4
- Red Hat build of Keycloak 26.4.16
- Broken access control
- CVSS 7.5 High
Keycloak-services: keycloak-services: unauthenticated dos via unbounded locale caching
- Red Hat build of Keycloak 26.4
- Red Hat build of Keycloak 26.4.16
- Denial of service
- CVSS 8.1 High
Keycloak-services: keycloak-services: incomplete fix for cve-2026-15573 allows policy enforcer bypass via percent-encoded uri segments
- Red Hat build of Keycloak 26.4
- Red Hat build of Keycloak 26.4.16
- Broken access control
- CVSS 7.5 High
Keycloak-services: keycloak-services: saml redirect deflate helpers leak native zlib state
- Red Hat build of Keycloak 26.4
- Red Hat build of Keycloak 26.4.16
- Denial of service
- CVSS 4.9 Medium
Keycloak-services: keycloak-services: incomplete fix for arbitrary filesystem path probing via keystore parameters
- Red Hat build of Keycloak 26.4
- Red Hat build of Keycloak 26.4.16
- Path traversal