Advisories · Technology
Red Hat build of Keycloak 26.6.7.
Every CVE that names Red Hat build of Keycloak 26.6.7 among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 5.3 Medium
Keycloak-services: keycloak-services: broker-originated username collision causes account lockout
- Red Hat build of Keycloak 26.4
- Red Hat build of Keycloak 26.4.16
- Authentication bypass
- CVSS 7.2 High
Keycloak-services: keycloak-services: privilege escalation via impersonation role allows takeover of realm administrator accounts
- Red Hat build of Keycloak 26.4
- Red Hat build of Keycloak 26.4.16
- Broken access control
- CVSS 7.5 High
Keycloak-services: keycloak-services: unauthenticated dos via unbounded locale caching
- Red Hat build of Keycloak 26.4
- Red Hat build of Keycloak 26.4.16
- Denial of service
- CVSS 8.1 High
Keycloak-services: keycloak-services: incomplete fix for cve-2026-15573 allows policy enforcer bypass via percent-encoded uri segments
- Red Hat build of Keycloak 26.4
- Red Hat build of Keycloak 26.4.16
- Broken access control
- CVSS 7.5 High
Keycloak-services: keycloak-services: saml redirect deflate helpers leak native zlib state
- Red Hat build of Keycloak 26.4
- Red Hat build of Keycloak 26.4.16
- Denial of service
- CVSS 4.9 Medium
Keycloak-services: keycloak-services: incomplete fix for arbitrary filesystem path probing via keystore parameters
- Red Hat build of Keycloak 26.4
- Red Hat build of Keycloak 26.4.16
- Path traversal
- CVSS 7.5 High
Resteasy-core: resteasy sourceprovider remote unauthenticated file read
- Red Hat Build of Apache Camel 3.33.3.SP1
- Red Hat build of Keycloak 26.6
- XML external entities (XXE)
- CVSS 5.9 Medium
Keycloak-services: keycloak-services: jwt bearer authorization grant does not enforce consentrequired
- Red Hat build of Keycloak 26.6
- Red Hat build of Keycloak 26.6.7
- Broken access control
- CVSS 6.5 Medium
Keycloak-services: keycloak-services: client access-type policy condition bypass during client update
- Red Hat build of Keycloak 26.6
- Red Hat build of Keycloak 26.6.7
- Broken access control
- CVSS 6.5 Medium
Keycloak-services: keycloak-services: uma claim token can override authorization time-policy evaluation attributes
- Red Hat build of Keycloak 26.6
- Red Hat build of Keycloak 26.6.7
- Broken access control
- CVSS 6.6 Medium
Keycloak-services: keycloak-services: fgap v2 group assignment bypass during user creation
- Red Hat build of Keycloak 26.6
- Red Hat build of Keycloak 26.6.7
- Broken access control
- CVSS 5.4 Medium
Keycloak-services: keycloak-services: full-scope-disabled client policy validation bypass via omitted fullscopeallowed
- Red Hat build of Keycloak 26.6
- Red Hat build of Keycloak 26.6.7
- Broken access control
- CVSS 3.4 Low
Keycloak-services: keycloak-services: oidc redirect_uri fragment bypass in http parameter pollution check
- Red Hat build of Keycloak 26.6
- Red Hat build of Keycloak 26.6.7
- CWE-1288
- CVSS 6.8 Medium
Keycloak-services: keycloak-services: google external access-token exchange bypasses hosted-domain restriction
- Red Hat build of Keycloak 26.6
- Red Hat build of Keycloak 26.6.7
- Broken access control
- CVSS 4.9 Medium
Keycloak-services: keycloak-services: missing per-role authorization on rolecontainerresource composite endpoints
- Red Hat build of Keycloak 26.6
- Red Hat build of Keycloak 26.6.7
- Broken access control
- CVSS 6.8 Medium
Keycloak-services: keycloak-services: microsoft external access-token exchange bypasses configured tenant
- Red Hat build of Keycloak 26.6
- Red Hat build of Keycloak 26.6.7
- Authentication bypass
- CVSS 4.2 Medium
Keycloak-services: keycloak-services: client not-before revocation ignored when realm not-before is older but nonzero
- Red Hat build of Keycloak 26.6
- Red Hat build of Keycloak 26.6.7
- Broken access control
- CVSS 5.5 Medium
Keycloak-services: keycloak-services: generic identity-provider creation can bind brokers to organizations without manage-organizations
- Red Hat build of Keycloak 26.6
- Red Hat build of Keycloak 26.6.7
- Broken access control
- CVSS 6.5 Medium
Keycloak-services: keycloak-services: information disclosure via role-users endpoint bypasses per-user view filter
- Red Hat build of Keycloak 26.6
- Red Hat build of Keycloak 26.6.7
- Broken access control
- CVSS 4.3 Medium
Keycloak-services: keycloak-services: authenticator config endpoint exposes raw recaptcha secrets to view-only admins
- Red Hat build of Keycloak 26.6
- Red Hat build of Keycloak 26.6.7
- Hard-coded credentials
- CWE-212
- CVSS 4.9 Medium
Keycloak-services: keycloak-services: incorrect authorization in admin role-composite deletion allows delegated admin to remove privileged child roles
- Red Hat build of Keycloak 26.6
- Red Hat build of Keycloak 26.6.7
- Broken access control
- CWE-1220
- CVSS 4.3 Medium
Keycloak-services: keycloak-services: realm default-group reads disclose hidden groups under fgap v2
- Red Hat build of Keycloak 26.6
- Red Hat build of Keycloak 26.6.7
- Information disclosure
- CWE-1220
- CVSS 5.4 Medium
Keycloak-services: keycloak-services: required signed-jwt assertion policy can be bypassed with unsigned assertion headers
- Red Hat build of Keycloak 26.6
- Red Hat build of Keycloak 26.6.7
- CWE-807
- CVSS 5.4 Medium
Keycloak-services: keycloak-services: authorization codes can be retargeted to another client session
- Red Hat build of Keycloak 26.6
- Red Hat build of Keycloak 26.6.7
- Authentication bypass
- CWE-472
- CVSS 4.9 Medium
Keycloak-services: keycloak-services: organization invitation link exposure allows unauthorized member creation
- Red Hat build of Keycloak 26.6
- Red Hat build of Keycloak 26.6.7
- Broken access control
- Information disclosure
- CVSS 4.3 Medium
Keycloak-services: keycloak-services: group hierarchy search discloses hidden parent groups under fgap v2
- Red Hat build of Keycloak 26.6
- Red Hat build of Keycloak 26.6.7
- Broken access control