Advisories · Technology
Red Hat build of Keycloak 26.6.8.
Every CVE that names Red Hat build of Keycloak 26.6.8 among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 6.4 Medium
Keycloak-services: keycloak-services: cross-session email verification proof not bound to upstream identity for social providers
- Red Hat build of Keycloak 26.6.8
- Red Hat Single Sign-On 7
- Broken access control
- CVSS 7.4 High
Wildfly-elytron: org.wildfly.security/wildfly-elytron-password-impl: wildfly-elytron: password keyspace reduction via nfkc fullwidth folding
- Red Hat Build of Apache Camel 3.33.3.SP2
- Red Hat Build of Debezium 3.6
- CWE-173
- CVSS 5.3 Medium
Keycloak-services: keycloak-services: name-only group claims let same-name groups satisfy path-specific group policies
- Red Hat build of Keycloak 26.6
- Red Hat build of Keycloak 26.6.8
- Broken access control
- CVSS 6.5 Medium
Keycloak-services: keycloak-services: group policy extendchildren matches sibling group path prefixes
- Red Hat build of Keycloak 26.6
- Red Hat build of Keycloak 26.6.8
- Broken access control
- CVSS 6.5 Medium
Keycloak-services: keycloak-services: inactive out-of-audience token introspection leaks signed jwt claim
- Red Hat build of Keycloak 26.6
- Red Hat build of Keycloak 26.6.8
- Broken access control
- CVSS 3.4 Low
Keycloak-services: keycloak-services: saml http-redirect binding response preserves query string leading to parameter pollution
- Red Hat build of Keycloak 26.4
- Red Hat build of Keycloak 26.4.17
- CWE-20
- CVSS 6.5 Medium
Keycloak-services: keycloak-services: client policy source-group condition bypass via duplicate group name matching
- Red Hat build of Keycloak 26.6
- Red Hat build of Keycloak 26.6.8
- Broken access control
- CVSS 4.3 Medium
Keycloak-services: keycloak-services: incomplete fix for ciba brute-force lockout bypass at token redemption
- Red Hat build of Keycloak 26.6
- Red Hat build of Keycloak 26.6.8
- CWE-305
- CWE-841
- CVSS 5.5 Medium
Keycloak-services: keycloak-services: oidc idp update reuses masked client secret after token url change
- Red Hat build of Keycloak 26.6
- Red Hat build of Keycloak 26.6.8
- CWE-1288
- CVSS 6.5 Medium
Keycloak-broker: keycloak: privilege escalation to realm administrator via improper authorization in identity provider mapper
- Red Hat build of Keycloak 26.6
- Red Hat build of Keycloak 26.6.8
- Privilege escalation