# Red Hat build of Keycloak 26.6.7. Every CVE that names Red Hat build of Keycloak 26.6.7 among its affected products, newest first. Vendors and products are as the CNA wrote them. ## Records, newest first - [Keycloak-services: keycloak-services: broker-originated username collision causes account lockout](https://agentprime.io/advisories/CVE-2026-19607.md) `CVE-2026-19607` · CVE record: Red Hat Red Hat build of Keycloak 26.4 and 4 more · CVSS 5.3 Medium · Not analysed yet · Published 16 Sept 2026 · Tags: Authentication bypass - [Keycloak-services: keycloak-services: privilege escalation via impersonation role allows takeover of realm administrator accounts](https://agentprime.io/advisories/CVE-2026-17526.md) `CVE-2026-17526` · CVE record: Red Hat Red Hat build of Keycloak 26.4 and 4 more · CVSS 7.2 High · Not analysed yet · Published 16 Sept 2026 · Tags: Broken access control - [Keycloak-services: keycloak-services: unauthenticated dos via unbounded locale caching](https://agentprime.io/advisories/CVE-2026-79651.md) `CVE-2026-79651` · CVE record: Red Hat Red Hat build of Keycloak 26.4 and 4 more · CVSS 7.5 High · Not analysed yet · Published 16 Sept 2026 · Tags: Denial of service - [Keycloak-services: keycloak-services: incomplete fix for cve-2026-15573 allows policy enforcer bypass via percent-encoded uri segments](https://agentprime.io/advisories/CVE-2026-74909.md) `CVE-2026-74909` · CVE record: Red Hat Red Hat build of Keycloak 26.4 and 4 more · CVSS 8.1 High · Not analysed yet · Published 16 Sept 2026 · Tags: Broken access control - [Keycloak-services: keycloak-services: saml redirect deflate helpers leak native zlib state](https://agentprime.io/advisories/CVE-2026-18212.md) `CVE-2026-18212` · CVE record: Red Hat Red Hat build of Keycloak 26.4 and 4 more · CVSS 7.5 High · Not analysed yet · Published 16 Sept 2026 · Tags: Denial of service - [Keycloak-services: keycloak-services: incomplete fix for arbitrary filesystem path probing via keystore parameters](https://agentprime.io/advisories/CVE-2026-19729.md) `CVE-2026-19729` · CVE record: Red Hat Red Hat build of Keycloak 26.4 and 4 more · CVSS 4.9 Medium · Not analysed yet · Published 9 Sept 2026 · Tags: Path traversal - [Resteasy-core: resteasy sourceprovider remote unauthenticated file read](https://agentprime.io/advisories/CVE-2026-17615.md) `CVE-2026-17615` · CVE record: Red Hat Red Hat Build of Apache Camel 3.33.3.SP1 and 4 more · CVSS 7.5 High · Not analysed yet · Published 31 Aug 2026 · Tags: XML external entities (XXE) - [Keycloak-services: keycloak-services: jwt bearer authorization grant does not enforce consentrequired](https://agentprime.io/advisories/CVE-2026-79652.md) `CVE-2026-79652` · CVE record: Red Hat Red Hat build of Keycloak 26.6 and 2 more · CVSS 5.9 Medium · Not analysed yet · Published 25 Aug 2026 · Tags: Broken access control - [Keycloak-services: keycloak-services: client access-type policy condition bypass during client update](https://agentprime.io/advisories/CVE-2026-18573.md) `CVE-2026-18573` · CVE record: Red Hat Red Hat build of Keycloak 26.6 and 4 more · CVSS 6.5 Medium · Not analysed yet · Published 2 Aug 2026 · Tags: Broken access control - [Keycloak-services: keycloak-services: uma claim token can override authorization time-policy evaluation attributes](https://agentprime.io/advisories/CVE-2026-18572.md) `CVE-2026-18572` · CVE record: Red Hat Red Hat build of Keycloak 26.6 and 4 more · CVSS 6.5 Medium · Not analysed yet · Published 2 Aug 2026 · Tags: Broken access control - [Keycloak-services: keycloak-services: fgap v2 group assignment bypass during user creation](https://agentprime.io/advisories/CVE-2026-18571.md) `CVE-2026-18571` · CVE record: Red Hat Red Hat build of Keycloak 26.6 and 4 more · CVSS 6.6 Medium · Not analysed yet · Published 2 Aug 2026 · Tags: Broken access control - [Keycloak-services: keycloak-services: full-scope-disabled client policy validation bypass via omitted fullscopeallowed](https://agentprime.io/advisories/CVE-2026-18570.md) `CVE-2026-18570` · CVE record: Red Hat Red Hat build of Keycloak 26.6 and 4 more · CVSS 5.4 Medium · Not analysed yet · Published 2 Aug 2026 · Tags: Broken access control - [Keycloak-services: keycloak-services: oidc redirect_uri fragment bypass in http parameter pollution check](https://agentprime.io/advisories/CVE-2026-18209.md) `CVE-2026-18209` · CVE record: Red Hat Red Hat build of Keycloak 26.6 and 4 more · CVSS 3.4 Low · Not analysed yet · Published 31 Jul 2026 · Tags: CWE-1288 - [Keycloak-services: keycloak-services: google external access-token exchange bypasses hosted-domain restriction](https://agentprime.io/advisories/CVE-2026-18214.md) `CVE-2026-18214` · CVE record: Red Hat Red Hat build of Keycloak 26.6 and 4 more · CVSS 6.8 Medium · Not analysed yet · Published 31 Jul 2026 · Tags: Broken access control - [Keycloak-services: keycloak-services: missing per-role authorization on rolecontainerresource composite endpoints](https://agentprime.io/advisories/CVE-2026-16105.md) `CVE-2026-16105` · CVE record: Red Hat Red Hat build of Keycloak 26.6 and 4 more · CVSS 4.9 Medium · Not analysed yet · Published 31 Jul 2026 · Tags: Broken access control - [Keycloak-services: keycloak-services: microsoft external access-token exchange bypasses configured tenant](https://agentprime.io/advisories/CVE-2026-18215.md) `CVE-2026-18215` · CVE record: Red Hat Red Hat build of Keycloak 26.6 and 4 more · CVSS 6.8 Medium · Not analysed yet · Published 31 Jul 2026 · Tags: Authentication bypass - [Keycloak-services: keycloak-services: client not-before revocation ignored when realm not-before is older but nonzero](https://agentprime.io/advisories/CVE-2026-18218.md) `CVE-2026-18218` · CVE record: Red Hat Red Hat build of Keycloak 26.6 and 4 more · CVSS 4.2 Medium · Not analysed yet · Published 31 Jul 2026 · Tags: Broken access control - [Keycloak-services: keycloak-services: generic identity-provider creation can bind brokers to organizations without manage-organizations](https://agentprime.io/advisories/CVE-2026-18201.md) `CVE-2026-18201` · CVE record: Red Hat Red Hat build of Keycloak 26.6 and 4 more · CVSS 5.5 Medium · Not analysed yet · Published 29 Jul 2026 · Tags: Broken access control - [Keycloak-services: keycloak-services: information disclosure via role-users endpoint bypasses per-user view filter](https://agentprime.io/advisories/CVE-2026-17059.md) `CVE-2026-17059` · CVE record: Red Hat Red Hat build of Keycloak 26.6 and 4 more · CVSS 6.5 Medium · Not analysed yet · Published 24 Jul 2026 · Tags: Broken access control - [Keycloak-services: keycloak-services: authenticator config endpoint exposes raw recaptcha secrets to view-only admins](https://agentprime.io/advisories/CVE-2026-16104.md) `CVE-2026-16104` · CVE record: Red Hat Red Hat build of Keycloak 26.6 and 4 more · CVSS 4.3 Medium · Not analysed yet · Published 17 Jul 2026 · Tags: Hard-coded credentials, CWE-212 - [Keycloak-services: keycloak-services: incorrect authorization in admin role-composite deletion allows delegated admin to remove privileged child roles](https://agentprime.io/advisories/CVE-2026-16106.md) `CVE-2026-16106` · CVE record: Red Hat Red Hat build of Keycloak 26.6 and 4 more · CVSS 4.9 Medium · Not analysed yet · Published 17 Jul 2026 · Tags: Broken access control, CWE-1220 - [Keycloak-services: keycloak-services: realm default-group reads disclose hidden groups under fgap v2](https://agentprime.io/advisories/CVE-2026-16108.md) `CVE-2026-16108` · CVE record: Red Hat Red Hat build of Keycloak 26.6 and 4 more · CVSS 4.3 Medium · Not analysed yet · Published 17 Jul 2026 · Tags: Information disclosure, CWE-1220 - [Keycloak-services: keycloak-services: required signed-jwt assertion policy can be bypassed with unsigned assertion headers](https://agentprime.io/advisories/CVE-2026-16093.md) `CVE-2026-16093` · CVE record: Red Hat Red Hat build of Keycloak 26.6 and 4 more · CVSS 5.4 Medium · Not analysed yet · Published 17 Jul 2026 · Tags: CWE-807 - [Keycloak-services: keycloak-services: authorization codes can be retargeted to another client session](https://agentprime.io/advisories/CVE-2026-16089.md) `CVE-2026-16089` · CVE record: Red Hat Red Hat build of Keycloak 26.6 and 4 more · CVSS 5.4 Medium · Not analysed yet · Published 17 Jul 2026 · Tags: Authentication bypass, CWE-472 - [Keycloak-services: keycloak-services: organization invitation link exposure allows unauthorized member creation](https://agentprime.io/advisories/CVE-2026-16072.md) `CVE-2026-16072` · CVE record: Red Hat Red Hat build of Keycloak 26.6 and 4 more · CVSS 4.9 Medium · Not analysed yet · Published 17 Jul 2026 · Tags: Broken access control, Information disclosure - [Keycloak-services: keycloak-services: group hierarchy search discloses hidden parent groups under fgap v2](https://agentprime.io/advisories/CVE-2026-15945.md) `CVE-2026-15945` · CVE record: Red Hat Red Hat build of Keycloak 26.6 and 4 more · CVSS 4.3 Medium · Not analysed yet · Published 16 Jul 2026 · Tags: Broken access control ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .