# Red Hat build of Keycloak 26.6.8. Every CVE that names Red Hat build of Keycloak 26.6.8 among its affected products, newest first. Vendors and products are as the CNA wrote them. ## Records, newest first - [Keycloak-services: keycloak-services: protocol mapper with jsontype=json bypasses token sanitization](https://agentprime.io/advisories/CVE-2026-97848.md) `CVE-2026-97848` · CVE record: Red Hat Red Hat build of Keycloak 26.4 and 4 more · CVSS 6.5 Medium · Not analysed yet · Published 6 Nov 2026 · Tags: CWE-20 - [Keycloak-services: keycloak-services: dcr azp and sid claim substitution allows account rest session takeover](https://agentprime.io/advisories/CVE-2026-97367.md) `CVE-2026-97367` · CVE record: Red Hat Red Hat build of Keycloak 26.4 and 4 more · CVSS 6.4 Medium · Not analysed yet · Published 6 Nov 2026 · Tags: Authentication bypass - [Keycloak-services: keycloak-services: dcr registration-time claim-path gap allows forging realm_access.roles](https://agentprime.io/advisories/CVE-2026-96547.md) `CVE-2026-96547` · CVE record: Red Hat Red Hat build of Keycloak 26.4 and 4 more · CVSS 6.5 Medium · Not analysed yet · Published 6 Nov 2026 · Tags: Broken access control - [Keycloak-services: keycloak-services: indefinite access token renewal via standard token exchange v2](https://agentprime.io/advisories/CVE-2026-96460.md) `CVE-2026-96460` · CVE record: Red Hat Red Hat build of Keycloak 26.6 and 2 more · CVSS 5.4 Medium · Not analysed yet · Published 6 Nov 2026 · Tags: Authentication bypass - [Keycloak-services: keycloak-services: saml broker ignores proxyrestriction delegation constraints](https://agentprime.io/advisories/CVE-2026-92856.md) `CVE-2026-92856` · CVE record: Red Hat Red Hat build of Keycloak 26.6 and 2 more · CVSS 4.9 Medium · Not analysed yet · Published 6 Nov 2026 · Tags: Broken access control - [Keycloak-services: keycloak-services: admin api missing audience check](https://agentprime.io/advisories/CVE-2026-19688.md) `CVE-2026-19688` · CVE record: Red Hat Red Hat build of Keycloak 26.6 and 2 more · CVSS 6.8 Medium · Not analysed yet · Published 6 Nov 2026 · Tags: Authentication bypass - [Keycloak-services: keycloak-services: stateless token preferred_username fallback enables identity rebinding](https://agentprime.io/advisories/CVE-2026-96447.md) `CVE-2026-96447` · CVE record: Red Hat Red Hat build of Keycloak 26.6 and 2 more · CVSS 4.2 Medium · Not analysed yet · Published 6 Nov 2026 · Tags: Authentication bypass - [Keycloak-services: keycloak-services: injection of roles into realm default-roles via dcr endpoint](https://agentprime.io/advisories/CVE-2026-109081.md) `CVE-2026-109081` · CVE record: Red Hat Red Hat build of Keycloak 26.6 and 2 more · CVSS 6.8 Medium · Not analysed yet · Published 6 Nov 2026 · Tags: Broken access control - [Keycloak-services: keycloak-services: oidc logout endpoint session fixation via id_token_hint leading to account takeover](https://agentprime.io/advisories/CVE-2026-107124.md) `CVE-2026-107124` · CVE record: Red Hat Red Hat build of Keycloak 26.6 and 2 more · CVSS 6.4 Medium · Not analysed yet · Published 6 Nov 2026 · Tags: Authentication bypass - [Keycloak-services: keycloak-services: client manager can substitute sessionless token principal via hardcoded-claim mappers to obtain realm administrator authority](https://agentprime.io/advisories/CVE-2026-97847.md) `CVE-2026-97847` · CVE record: Red Hat Red Hat build of Keycloak 26.4 and 4 more · CVSS 7.1 High · Not analysed yet · Published 5 Nov 2026 · Tags: Authentication bypass - [Keycloak-services: keycloak-services: unverified idp email auto-linking enables account takeover](https://agentprime.io/advisories/CVE-2026-97175.md) `CVE-2026-97175` · CVE record: Red Hat Red Hat build of Keycloak 26.4.17 and 2 more · CVSS 8.8 High · Not analysed yet · Published 5 Nov 2026 · Tags: Authentication bypass - [Keycloak-services: keycloak-services: ciba sub parameter injection causes attacker authentication to issue victim tokens](https://agentprime.io/advisories/CVE-2026-97174.md) `CVE-2026-97174` · CVE record: Red Hat Red Hat build of Keycloak 26.6 and 2 more · CVSS 6.8 Medium · Not analysed yet · Published 5 Nov 2026 · Tags: CWE-20 - [Org.keycloak/keycloak-admin-cli: keycloak-admin-cli: kcadm custom truststore accepts arbitrary self-signed certificates](https://agentprime.io/advisories/CVE-2026-96453.md) `CVE-2026-96453` · CVE record: Red Hat Red Hat build of Keycloak 26.4 and 4 more · CVSS 8.0 High · Not analysed yet · Published 5 Nov 2026 · Tags: Weak cryptography or TLS - [Keycloak-core: keycloak-core: saml adapter does not bind signed assertions to the configured identity provider issuer](https://agentprime.io/advisories/CVE-2026-93998.md) `CVE-2026-93998` · CVE record: Red Hat Red Hat build of Keycloak 26.4 and 4 more · CVSS 7.4 High · Not analysed yet · Published 5 Nov 2026 · Tags: Weak cryptography or TLS - [Keycloak-services: keycloak-services: dcr protocol mapper config not validated, allowing iat holders to forge sub and aud claims in signed tokens](https://agentprime.io/advisories/CVE-2026-92857.md) `CVE-2026-92857` · CVE record: Red Hat Red Hat build of Keycloak 26.4 and 4 more · CVSS 8.1 High · Not analysed yet · Published 5 Nov 2026 · Tags: CWE-20 - [Keycloak-services: keycloak-services: saml broker accepts holder-of-key assertions without proof of key possession](https://agentprime.io/advisories/CVE-2026-92855.md) `CVE-2026-92855` · CVE record: Red Hat Red Hat build of Keycloak 26.4 and 4 more · CVSS 7.4 High · Not analysed yet · Published 5 Nov 2026 · Tags: Authentication bypass - [Keycloak-services: keycloak-services: unauthenticated denial of service via saml soap endpoint unbounded xml parsing](https://agentprime.io/advisories/CVE-2026-82965.md) `CVE-2026-82965` · CVE record: Red Hat Red Hat build of Keycloak 26.4 and 4 more · CVSS 7.5 High · Not analysed yet · Published 5 Nov 2026 · Tags: Denial of service - [Keycloak-services: keycloak-services: uma protection api resourcetype field not validated — cross-owner resource access](https://agentprime.io/advisories/CVE-2026-114232.md) `CVE-2026-114232` · CVE record: Red Hat Red Hat build of Keycloak 26.4 and 4 more · CVSS 8.1 High · Not analysed yet · Published 5 Nov 2026 · Tags: Broken access control - [Keycloak-services: keycloak-services: account takeover via stale sso_auth note in organization identity-first login](https://agentprime.io/advisories/CVE-2026-112208.md) `CVE-2026-112208` · CVE record: Red Hat Red Hat build of Keycloak 26.6 and 2 more · CVSS 8.1 High · Not analysed yet · Published 5 Nov 2026 · Tags: CWE-305 - [Keycloak-services: keycloak-services: unauthenticated persistent disk exhaustion via theme gzip cache](https://agentprime.io/advisories/CVE-2026-110932.md) `CVE-2026-110932` · CVE record: Red Hat Red Hat build of Keycloak 26.6 and 2 more · CVSS 7.5 High · Not analysed yet · Published 5 Nov 2026 · Tags: Denial of service - [Keycloak-services: keycloak-services: unauthenticated jvm termination via saml 1.1 authoritybinding parsing loop](https://agentprime.io/advisories/CVE-2026-110931.md) `CVE-2026-110931` · CVE record: Red Hat Red Hat build of Keycloak 26.4 and 4 more · CVSS 7.5 High · Not analysed yet · Published 5 Nov 2026 · Tags: Denial of service - [Keycloak-services: keycloak-services: unauthenticated cpu exhaustion via saml 1.1 keyinfo infinite loop](https://agentprime.io/advisories/CVE-2026-107602.md) `CVE-2026-107602` · CVE record: Red Hat Red Hat build of Keycloak 26.4 and 4 more · CVSS 7.5 High · Not analysed yet · Published 5 Nov 2026 · Tags: Denial of service - [Keycloak-services: keycloak-services: account takeover via authentication race using reset-credentials path](https://agentprime.io/advisories/CVE-2026-103112.md) `CVE-2026-103112` · CVE record: Red Hat Red Hat build of Keycloak 26.4 and 4 more · CVSS 7.5 High · Not analysed yet · Published 5 Nov 2026 · Tags: Race condition - [Keycloak-services: keycloak-services: unauthenticated cpu denial of service via saml xml datetime and duration parsing](https://agentprime.io/advisories/CVE-2026-107123.md) `CVE-2026-107123` · CVE record: Red Hat Red Hat build of Keycloak 26.6 and 2 more · CVSS 7.5 High · Not analysed yet · Published 5 Nov 2026 · Tags: Denial of service - [Keycloak-services: keycloak-services: stored xss on login page via kcsanitize bypass](https://agentprime.io/advisories/CVE-2026-107889.md) `CVE-2026-107889` · CVE record: Red Hat Red Hat build of Keycloak 26.6 and 2 more · CVSS 5.5 Medium · Not analysed yet · Published 9 Oct 2026 · Tags: Cross-site scripting (XSS) - [Keycloak-services: keycloak-services: oidc dcr read-modify-write silently disables offline token revocation](https://agentprime.io/advisories/CVE-2026-107623.md) `CVE-2026-107623` · CVE record: Red Hat Red Hat build of Keycloak 26.6 and 2 more · CVSS 4.3 Medium · Not analysed yet · Published 8 Oct 2026 · Tags: Broken access control - [Keycloak-services: keycloak-services: smtp starttls plaintext credential and message downgrade](https://agentprime.io/advisories/CVE-2026-107121.md) `CVE-2026-107121` · CVE record: Red Hat Red Hat build of Keycloak 26.6 and 2 more · CVSS 6.5 Medium · Not analysed yet · Published 7 Oct 2026 · Tags: Weak cryptography or TLS - [Keycloak-services: keycloak-services: device authorization grant bypasses per-client minimum.acr.value enforcement](https://agentprime.io/advisories/CVE-2026-105305.md) `CVE-2026-105305` · CVE record: Red Hat Red Hat build of Keycloak 26.6 and 2 more · CVSS 5.4 Medium · Not analysed yet · Published 6 Oct 2026 · Tags: Authentication bypass - [Keycloak-services: keycloak-services: path traversal in x.509 crl distribution point allows arbitrary local file read](https://agentprime.io/advisories/CVE-2026-103884.md) `CVE-2026-103884` · CVE record: Red Hat Red Hat build of Keycloak 26.6 and 2 more · CVSS 6.5 Medium · Not analysed yet · Published 1 Oct 2026 · Tags: Path traversal - [Keycloak-services: keycloak-services: unbounded metric series creation via idp tag on broker login endpoint](https://agentprime.io/advisories/CVE-2026-101333.md) `CVE-2026-101333` · CVE record: Red Hat Red Hat build of Keycloak 26.6.8 and 1 more · CVSS 3.7 Low · Not analysed yet · Published 28 Sept 2026 · Tags: Denial of service - [Keycloak-services: keycloak-services: fgap v2 composite-blind role mapping allows privilege escalation](https://agentprime.io/advisories/CVE-2026-96448.md) `CVE-2026-96448` · CVE record: Red Hat Red Hat build of Keycloak 26.6.8 and 1 more · CVSS 6.6 Medium · Not analysed yet · Published 25 Sept 2026 · Tags: Broken access control - [Keycloak-services: keycloak-services: standard token exchange v2 bypasses mtls holder-of-key binding](https://agentprime.io/advisories/CVE-2026-97846.md) `CVE-2026-97846` · CVE record: Red Hat Red Hat build of Keycloak 26.6.8 and 1 more · CVSS 6.8 Medium · Not analysed yet · Published 25 Sept 2026 · Tags: Authentication bypass - [Keycloak-services: keycloak-services: admin rest api role-groups endpoint discloses groups without authorization](https://agentprime.io/advisories/CVE-2026-97311.md) `CVE-2026-97311` · CVE record: Red Hat Red Hat build of Keycloak 26.6.8 and 1 more · CVSS 4.3 Medium · Not analysed yet · Published 24 Sept 2026 · Tags: Broken access control - [Keycloak-services: keycloak-services: generic user update bypasses denied reset-password permission](https://agentprime.io/advisories/CVE-2026-97177.md) `CVE-2026-97177` · CVE record: Red Hat Red Hat build of Keycloak 26.6.8 and 1 more · CVSS 6.6 Medium · Not analysed yet · Published 24 Sept 2026 · Tags: Broken access control - [Keycloak-services: keycloak-services: conditional otp skip-header policy evaluated against untrusted proxy headers](https://agentprime.io/advisories/CVE-2026-96445.md) `CVE-2026-96445` · CVE record: Red Hat Red Hat build of Keycloak 26.6.8 and 1 more · CVSS 6.8 Medium · Not analysed yet · Published 23 Sept 2026 · Tags: Authentication bypass - [Keycloak-services: keycloak-services: par single-use bypass via prompt=none silent authentication path](https://agentprime.io/advisories/CVE-2026-96446.md) `CVE-2026-96446` · CVE record: Red Hat Red Hat build of Keycloak 26.6.8 and 1 more · CVSS 4.2 Medium · Not analysed yet · Published 23 Sept 2026 · Tags: Broken access control - [Keycloak-services: keycloak-services: potential kdc spoofing bypass when kerberos password authentication is enabled](https://agentprime.io/advisories/CVE-2026-95503.md) `CVE-2026-95503` · CVE record: Red Hat Red Hat build of Keycloak 26.6.8 and 1 more · CVSS 6.8 Medium · Not analysed yet · Published 22 Sept 2026 · Tags: Weak cryptography or TLS - [Keycloak-services: keycloak-services: uma scope merge across resource owners via resource name collision](https://agentprime.io/advisories/CVE-2026-94217.md) `CVE-2026-94217` · CVE record: Red Hat Red Hat build of Keycloak 26.6.8 and 1 more · CVSS 3.5 Low · Not analysed yet · Published 21 Sept 2026 · Tags: Broken access control - [Keycloak-services: keycloak-services: cross-realm client read/write via request-level cache missing realm ownership check](https://agentprime.io/advisories/CVE-2026-94215.md) `CVE-2026-94215` · CVE record: Red Hat Red Hat build of Keycloak 26.6.8 and 1 more · CVSS 5.5 Medium · Not analysed yet · Published 21 Sept 2026 · Tags: Broken access control - [Keycloak-services: keycloak-services: authorization services policy evaluation endpoint leaks user identity](https://agentprime.io/advisories/CVE-2026-94213.md) `CVE-2026-94213` · CVE record: Red Hat Red Hat build of Keycloak 26.6.8 and 1 more · CVSS 4.9 Medium · Not analysed yet · Published 21 Sept 2026 · Tags: Broken access control - [Keycloak-services: keycloak-services: admin credential delete bypasses denied reset-password permission](https://agentprime.io/advisories/CVE-2026-94001.md) `CVE-2026-94001` · CVE record: Red Hat Red Hat build of Keycloak 26.6 and 2 more · CVSS 6.5 Medium · Not analysed yet · Published 19 Sept 2026 · Tags: Broken access control - [Keycloak-services: keycloak-services: delegated admin with manage-users can escalate to realm-admin via group membership](https://agentprime.io/advisories/CVE-2026-94000.md) `CVE-2026-94000` · CVE record: Red Hat Red Hat build of Keycloak 26.6 and 2 more · CVSS 6.6 Medium · Not analysed yet · Published 19 Sept 2026 · Tags: Broken access control - [Keycloak-services: keycloak-services: token refresh continues issuing tokens for disabled audience clients](https://agentprime.io/advisories/CVE-2026-93999.md) `CVE-2026-93999` · CVE record: Red Hat Red Hat build of Keycloak 26.6 and 2 more · CVSS 4.2 Medium · Not analysed yet · Published 19 Sept 2026 · Tags: Broken access control - [Io.netty/netty-codec-http: netty: incomplete validation of malformed transfer-encoding allows http request smuggling](https://agentprime.io/advisories/CVE-2026-93562.md) `CVE-2026-93562` · CVE record: Red Hat Red Hat Build of Debezium 3.6 and 4 more · CVSS 6.5 Medium · Not analysed yet · Published 18 Sept 2026 · Tags: CWE-1035 - [Io.netty/netty-codec-http: netty: http request smuggling via post-digit whitespace in chunk-size parsing](https://agentprime.io/advisories/CVE-2026-93574.md) `CVE-2026-93574` · CVE record: Red Hat Red Hat Build of Debezium 3.6 and 4 more · CVSS 6.5 Medium · Not analysed yet · Published 18 Sept 2026 · Tags: HTTP request smuggling - [Io.netty/netty-codec-http2: netty: http/2 header field values are not validated by default (cr/lf/nul passthrough)](https://agentprime.io/advisories/CVE-2026-93579.md) `CVE-2026-93579` · CVE record: Red Hat Red Hat Build of Debezium 3.6 and 4 more · CVSS 6.5 Medium · Not analysed yet · Published 18 Sept 2026 · Tags: CWE-1035 - [Io.netty/netty-codec-http: netty split transfer-encoding fields bypass final-chunked validation and enable request smuggling](https://agentprime.io/advisories/CVE-2026-93573.md) `CVE-2026-93573` · CVE record: Red Hat Red Hat Build of Debezium 3.6 and 4 more · CVSS 6.5 Medium · Not analysed yet · Published 18 Sept 2026 · Tags: HTTP request smuggling - [Io.netty/netty-codec-http2: io.netty/netty-codec-http3: netty: http/2 and http/3 extended connect requests are downgraded as regular connect requests](https://agentprime.io/advisories/CVE-2026-93568.md) `CVE-2026-93568` · CVE record: Red Hat Red Hat Build of Apache Camel 3.33.3.SP2 and 4 more · CVSS 7.5 High · Not analysed yet · Published 18 Sept 2026 · Tags: CWE-20 - [Io.netty/netty-codec-http2: http/1 absolute-form host mismatch is translated to http/2 :authority, overriding the request-target authority](https://agentprime.io/advisories/CVE-2026-93569.md) `CVE-2026-93569` · CVE record: Red Hat Red Hat Build of Apache Camel 3.33.3.SP2 and 4 more · CVSS 8.2 High · Not analysed yet · Published 18 Sept 2026 · Tags: HTTP request smuggling - [Io.netty/netty-codec-http2: http/1 authority-form connect is translated to malformed http/2 connect with host-controlled :authority](https://agentprime.io/advisories/CVE-2026-93567.md) `CVE-2026-93567` · CVE record: Red Hat Red Hat Build of Apache Camel 3.33.3.SP2 and 4 more · CVSS 7.5 High · Not analysed yet · Published 18 Sept 2026 · Tags: CWE-20 - [Io.netty/netty-codec-http: netty: http request smuggling due to control characters in the chunk-size line](https://agentprime.io/advisories/CVE-2026-93566.md) `CVE-2026-93566` · CVE record: Red Hat Red Hat Build of Debezium 3.6 and 4 more · CVSS 6.5 Medium · Not analysed yet · Published 18 Sept 2026 · Tags: CWE-1035 - [Io.netty/netty-codec-http: netty rtspdecoder method-token smuggling via trailing control byte](https://agentprime.io/advisories/CVE-2026-93565.md) `CVE-2026-93565` · CVE record: Red Hat Red Hat Build of Apache Camel 3.33.3.SP2 and 4 more · CVSS 7.5 High · Not analysed yet · Published 18 Sept 2026 · Tags: CWE-1035 - [Io.netty/netty-codec-haproxy: netty: haproxy proxy-v2 nested-tlv grandchild bytebuf reference-count leak (incomplete fix of pr #16881)](https://agentprime.io/advisories/CVE-2026-93564.md) `CVE-2026-93564` · CVE record: Red Hat Red Hat Build of Apache Camel 3.33.3.SP2 and 4 more · CVSS 7.5 High · Not analysed yet · Published 18 Sept 2026 · Tags: CWE-1035 - [Io.netty/netty-codec-http: netty: unbounded per-connection queue growth in websocketserverextensionhandler leads to denial of service](https://agentprime.io/advisories/CVE-2026-93558.md) `CVE-2026-93558` · CVE record: Red Hat Red Hat Build of Apache Camel 3.33.3.SP2 and 4 more · CVSS 7.5 High · Not analysed yet · Published 18 Sept 2026 · Tags: CWE-1035 - [Io.netty/netty-codec-http2: netty: http/2 hpackencoder dos with large table size](https://agentprime.io/advisories/CVE-2026-93492.md) `CVE-2026-93492` · CVE record: Red Hat Red Hat Build of Debezium 3.6 and 4 more · CVSS 5.3 Medium · Not analysed yet · Published 18 Sept 2026 · Tags: CWE-1035 - [Io.netty/netty-codec-http: netty: denial of service via unbounded httpservercodec http/1.1 pipeline queue](https://agentprime.io/advisories/CVE-2026-93491.md) `CVE-2026-93491` · CVE record: Red Hat Red Hat Build of Apache Camel 3.33.3.SP2 and 4 more · CVSS 7.5 High · Not analysed yet · Published 18 Sept 2026 · Tags: Denial of service - [Io.netty/netty-codec-http: netty: denial of service via unbounded concurrent spdy streams](https://agentprime.io/advisories/CVE-2026-93488.md) `CVE-2026-93488` · CVE record: Red Hat Red Hat Build of Apache Camel 3.33.3.SP2 and 4 more · CVSS 7.5 High · Not analysed yet · Published 18 Sept 2026 · Tags: Denial of service - [Keycloak-services: keycloak-services: residual cross-browser account-link proof allows silent re-linking](https://agentprime.io/advisories/CVE-2026-92358.md) `CVE-2026-92358` · CVE record: Red Hat Red Hat build of Keycloak 26.6.8 and 1 more · CVSS 6.4 Medium · Not analysed yet · Published 16 Sept 2026 · Tags: Authentication bypass - [Keycloak-services: keycloak-services: confidential client secret disclosed to view-clients role via client registration get](https://agentprime.io/advisories/CVE-2026-89298.md) `CVE-2026-89298` · CVE record: Red Hat Red Hat build of Keycloak 26.6.8 and 1 more · CVSS 4.9 Medium · Not analysed yet · Published 11 Sept 2026 · Tags: Information disclosure - [Keycloak-services: keycloak-services: device authorization grant issues tokens to brute-force-locked accounts](https://agentprime.io/advisories/CVE-2026-88770.md) `CVE-2026-88770` · CVE record: Red Hat Red Hat build of Keycloak 26.6.8 and 1 more · CVSS 6.5 Medium · Not analysed yet · Published 10 Sept 2026 · Tags: Authentication bypass Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .