# Red Hat Single Sign-On 7. Every CVE that names Red Hat Single Sign-On 7 among its affected products, newest first. Vendors and products are as the CNA wrote them. ## Records, newest first - [Keycloak-services: keycloak-services: client manager can substitute sessionless token principal via hardcoded-claim mappers to obtain realm administrator authority](https://agentprime.io/advisories/CVE-2026-97847.md) `CVE-2026-97847` · CVE record: Red Hat Red Hat Build of Keycloak and 1 more · CVSS 7.1 High · Not analysed yet · Published 5 Nov 2026 · Tags: Authentication bypass - [Keycloak-services: keycloak-services: unverified idp email auto-linking enables account takeover](https://agentprime.io/advisories/CVE-2026-97175.md) `CVE-2026-97175` · CVE record: Red Hat Red Hat Build of Keycloak and 1 more · CVSS 8.8 High · Not analysed yet · Published 5 Nov 2026 · Tags: Authentication bypass - [Keycloak-services: keycloak-services: ciba sub parameter injection causes attacker authentication to issue victim tokens](https://agentprime.io/advisories/CVE-2026-97174.md) `CVE-2026-97174` · CVE record: Red Hat Red Hat Build of Keycloak and 1 more · CVSS 6.8 Medium · Not analysed yet · Published 5 Nov 2026 · Tags: CWE-20 - [Org.keycloak/keycloak-admin-cli: keycloak-admin-cli: kcadm custom truststore accepts arbitrary self-signed certificates](https://agentprime.io/advisories/CVE-2026-96453.md) `CVE-2026-96453` · CVE record: Red Hat Red Hat AMQ Broker 7 and 4 more · CVSS 8.0 High · Not analysed yet · Published 5 Nov 2026 · Tags: Weak cryptography or TLS - [Keycloak-core: keycloak-core: saml adapter does not bind signed assertions to the configured identity provider issuer](https://agentprime.io/advisories/CVE-2026-93998.md) `CVE-2026-93998` · CVE record: Red Hat Red Hat AMQ Broker 7 and 4 more · CVSS 7.4 High · Not analysed yet · Published 5 Nov 2026 · Tags: Weak cryptography or TLS - [Keycloak-services: keycloak-services: dcr protocol mapper config not validated, allowing iat holders to forge sub and aud claims in signed tokens](https://agentprime.io/advisories/CVE-2026-92857.md) `CVE-2026-92857` · CVE record: Red Hat Red Hat Build of Keycloak and 1 more · CVSS 8.1 High · Not analysed yet · Published 5 Nov 2026 · Tags: CWE-20 - [Keycloak-services: keycloak-services: saml broker accepts holder-of-key assertions without proof of key possession](https://agentprime.io/advisories/CVE-2026-92855.md) `CVE-2026-92855` · CVE record: Red Hat Red Hat Build of Keycloak and 1 more · CVSS 7.4 High · Not analysed yet · Published 5 Nov 2026 · Tags: Authentication bypass - [Keycloak-services: keycloak-services: unauthenticated denial of service via saml soap endpoint unbounded xml parsing](https://agentprime.io/advisories/CVE-2026-82965.md) `CVE-2026-82965` · CVE record: Red Hat Red Hat Build of Keycloak and 1 more · CVSS 7.5 High · Not analysed yet · Published 5 Nov 2026 · Tags: Denial of service - [Keycloak-services: keycloak-services: uma protection api resourcetype field not validated — cross-owner resource access](https://agentprime.io/advisories/CVE-2026-114232.md) `CVE-2026-114232` · CVE record: Red Hat Red Hat Build of Keycloak and 1 more · CVSS 8.1 High · Not analysed yet · Published 5 Nov 2026 · Tags: Broken access control - [Keycloak-services: keycloak-services: account takeover via stale sso_auth note in organization identity-first login](https://agentprime.io/advisories/CVE-2026-112208.md) `CVE-2026-112208` · CVE record: Red Hat Red Hat Build of Keycloak and 1 more · CVSS 8.1 High · Not analysed yet · Published 5 Nov 2026 · Tags: CWE-305 - [Keycloak-services: keycloak-services: unauthenticated persistent disk exhaustion via theme gzip cache](https://agentprime.io/advisories/CVE-2026-110932.md) `CVE-2026-110932` · CVE record: Red Hat Red Hat Build of Keycloak and 1 more · CVSS 7.5 High · Not analysed yet · Published 5 Nov 2026 · Tags: Denial of service - [Keycloak-services: keycloak-services: unauthenticated jvm termination via saml 1.1 authoritybinding parsing loop](https://agentprime.io/advisories/CVE-2026-110931.md) `CVE-2026-110931` · CVE record: Red Hat Red Hat Build of Keycloak and 1 more · CVSS 7.5 High · Not analysed yet · Published 5 Nov 2026 · Tags: Denial of service - [Keycloak-services: keycloak-services: unauthenticated cpu exhaustion via saml 1.1 keyinfo infinite loop](https://agentprime.io/advisories/CVE-2026-107602.md) `CVE-2026-107602` · CVE record: Red Hat Red Hat Build of Keycloak and 1 more · CVSS 7.5 High · Not analysed yet · Published 5 Nov 2026 · Tags: Denial of service - [Keycloak-services: keycloak-services: account takeover via authentication race using reset-credentials path](https://agentprime.io/advisories/CVE-2026-103112.md) `CVE-2026-103112` · CVE record: Red Hat Red Hat Build of Keycloak and 1 more · CVSS 7.5 High · Not analysed yet · Published 5 Nov 2026 · Tags: Race condition - [Keycloak-services: keycloak-services: unauthenticated cpu denial of service via saml xml datetime and duration parsing](https://agentprime.io/advisories/CVE-2026-107123.md) `CVE-2026-107123` · CVE record: Red Hat Red Hat Build of Keycloak and 1 more · CVSS 7.5 High · Not analysed yet · Published 5 Nov 2026 · Tags: Denial of service - [Keycloak-services: keycloak-services: saml redirect binding signature bypass via percent-encoded parameter names](https://agentprime.io/advisories/CVE-2026-117691.md) `CVE-2026-117691` · CVE record: Red Hat Red Hat Build of Keycloak and 1 more · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Nov 2026 · Tags: Weak cryptography or TLS - [Undertow: undertow: chunkreader message length permits chunk-size overflow](https://agentprime.io/advisories/CVE-2026-91920.md) `CVE-2026-91920` · CVE record: Red Hat Red Hat build of Apache Camel for Spring Boot 4 and 4 more · CVSS 6.5 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: HTTP request smuggling - [Keycloak-services: keycloak-services: required actions bypassed via kc_action parameter](https://agentprime.io/advisories/CVE-2026-118959.md) `CVE-2026-118959` · CVE record: Red Hat Red Hat Build of Keycloak and 1 more · CVSS 5.4 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Authentication bypass - [Keycloak-services: keycloak-services: authorization bypass via uma resource registration idor](https://agentprime.io/advisories/CVE-2026-118947.md) `CVE-2026-118947` · CVE record: Red Hat Red Hat Build of Keycloak and 1 more · CVSS 4.3 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Broken access control - [Keycloak-services: keycloak-services: redirect uri domain allowlist bypass via dns resolution to loopback](https://agentprime.io/advisories/CVE-2026-118425.md) `CVE-2026-118425` · CVE record: Red Hat Red Hat Build of Keycloak and 1 more · CVSS 6.8 Medium · Not analysed yet · Published 29 Oct 2026 · Tags: Open redirect - [Keycloak-services: keycloak-services: hotp race condition allows single otp code reuse across concurrent logins](https://agentprime.io/advisories/CVE-2026-118030.md) `CVE-2026-118030` · CVE record: Red Hat Red Hat Build of Keycloak and 1 more · CVSS 4.2 Medium · Not analysed yet · Published 29 Oct 2026 · Tags: Race condition - [Keycloak-services: keycloak-services: par single-use bypass via flow restart](https://agentprime.io/advisories/CVE-2026-117859.md) `CVE-2026-117859` · CVE record: Red Hat Red Hat Build of Keycloak and 1 more · CVSS 5.4 Medium · Not analysed yet · Published 29 Oct 2026 · Tags: CWE-670 - [Keycloak-services: keycloak-services: vault secret disclosure via client registration installation configuration](https://agentprime.io/advisories/CVE-2026-117688.md) `CVE-2026-117688` · CVE record: Red Hat Red Hat Build of Keycloak and 1 more · CVSS 5.3 Medium · Not analysed yet · Published 29 Oct 2026 · Tags: Information disclosure - [Keycloak-services: keycloak-services: jwt authorization grant bypasses identity provider login restrictions](https://agentprime.io/advisories/CVE-2026-117627.md) `CVE-2026-117627` · CVE record: Red Hat Red Hat Build of Keycloak and 1 more · CVSS 5.4 Medium · Not analysed yet · Published 29 Oct 2026 · Tags: Broken access control - [Wildfly: wildfly-iiop: wildfly-ejb3: wildfly: authentication bypass on iiop ejb invocations as csiv2 ittprincipalname accepted without transport binding](https://agentprime.io/advisories/CVE-2026-114488.md) `CVE-2026-114488` · CVE record: Red Hat Red Hat Fuse 7 and 4 more · CVSS 7.4 High · Not analysed yet · Published 29 Oct 2026 · Tags: CWE-829 - [Wildfly-platform-mbean: wildfly-platform-mbean: rbac sensitive attribute read bypass for platform runtimemxbean](https://agentprime.io/advisories/CVE-2026-19610.md) `CVE-2026-19610` · CVE record: Red Hat Red Hat JBoss Enterprise Application Platform 7 and 3 more · CVSS 6.5 Medium · Not analysed yet · Published 29 Oct 2026 · Tags: Broken access control - [Keycloak-services: keycloak-services: required otp enrollment bypassed via update user locale required action ordering](https://agentprime.io/advisories/CVE-2026-114438.md) `CVE-2026-114438` · CVE record: Red Hat Red Hat Build of Keycloak and 1 more · CVSS 4.2 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Authentication bypass - [Undertow: undertow: pathresourcemanager safepaths check allows sibling-directory symlink traversal](https://agentprime.io/advisories/CVE-2026-114370.md) `CVE-2026-114370` · CVE record: Red Hat Red Hat build of Apache Camel for Spring Boot 4 and 4 more · CVSS 3.7 Low · Not analysed yet · Published 21 Oct 2026 · Tags: Path traversal - [Org.wildfly.core: wildfly: path traversal in take-snapshot discloses the server configuration to the monitor role](https://agentprime.io/advisories/CVE-2026-84823.md) `CVE-2026-84823` · CVE record: Red Hat Red Hat Enterprise Linux 8 and 4 more · CVSS 7.1 High · Not analysed yet · Published 15 Oct 2026 · Tags: Path traversal - [Wildfly-core: wildfly-core: deployer rbac role privilege escalation via path traversal in deployment name](https://agentprime.io/advisories/CVE-2026-85634.md) `CVE-2026-85634` · CVE record: Red Hat Red Hat Fuse 7 and 4 more · CVSS 8.8 High · Not analysed yet · Published 15 Oct 2026 · Tags: Path traversal - [Keycloak-services: keycloak-services: ciba confidential-only contract not enforced for public clients](https://agentprime.io/advisories/CVE-2026-109082.md) `CVE-2026-109082` · CVE record: Red Hat Red Hat Build of Keycloak and 1 more · CVSS 6.8 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Authentication bypass - [Keycloak-services: keycloak-services: stored xss on login page via kcsanitize bypass](https://agentprime.io/advisories/CVE-2026-107889.md) `CVE-2026-107889` · CVE record: Red Hat Red Hat Build of Keycloak and 1 more · CVSS 5.5 Medium · Not analysed yet · Published 9 Oct 2026 · Tags: Cross-site scripting (XSS) - [Keycloak-services: keycloak-services: oidc dcr read-modify-write silently disables offline token revocation](https://agentprime.io/advisories/CVE-2026-107623.md) `CVE-2026-107623` · CVE record: Red Hat Red Hat Build of Keycloak and 1 more · CVSS 4.3 Medium · Not analysed yet · Published 8 Oct 2026 · Tags: Broken access control - [Keycloak-services: keycloak-services: view-clients role allows retrieval of active client secrets via installation provider endpoints](https://agentprime.io/advisories/CVE-2026-107604.md) `CVE-2026-107604` · CVE record: Red Hat Red Hat Build of Keycloak and 1 more · CVSS 4.9 Medium · Not analysed yet · Published 8 Oct 2026 · Tags: Information disclosure - [Keycloak-services: keycloak-services: smtp starttls plaintext credential and message downgrade](https://agentprime.io/advisories/CVE-2026-107121.md) `CVE-2026-107121` · CVE record: Red Hat Red Hat Build of Keycloak and 1 more · CVSS 6.5 Medium · Not analysed yet · Published 7 Oct 2026 · Tags: Weak cryptography or TLS - [Keycloak-services: keycloak-services: device authorization grant bypasses per-client minimum.acr.value enforcement](https://agentprime.io/advisories/CVE-2026-105305.md) `CVE-2026-105305` · CVE record: Red Hat Red Hat Build of Keycloak and 1 more · CVSS 5.4 Medium · Not analysed yet · Published 6 Oct 2026 · Tags: Authentication bypass - [Keycloak-services: keycloak-services: token introspection audience bypass via dynamic client registration](https://agentprime.io/advisories/CVE-2026-105306.md) `CVE-2026-105306` · CVE record: Red Hat Red Hat Build of Keycloak and 1 more · CVSS 6.5 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Broken access control - [Keycloak-services: keycloak-services: user session note mapper exposes upstream idp access tokens](https://agentprime.io/advisories/CVE-2026-105302.md) `CVE-2026-105302` · CVE record: Red Hat Red Hat Build of Keycloak and 1 more · CVSS 5.7 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Information disclosure - [Keycloak-services: keycloak-services: path traversal in x.509 crl distribution point allows arbitrary local file read](https://agentprime.io/advisories/CVE-2026-103884.md) `CVE-2026-103884` · CVE record: Red Hat Red Hat Build of Keycloak and 1 more · CVSS 6.5 Medium · Not analysed yet · Published 1 Oct 2026 · Tags: Path traversal - [Keycloak-services: keycloak-services: unbounded metric series creation via idp tag on broker login endpoint](https://agentprime.io/advisories/CVE-2026-101333.md) `CVE-2026-101333` · CVE record: Red Hat Red Hat Build of Keycloak and 1 more · CVSS 3.7 Low · Not analysed yet · Published 28 Sept 2026 · Tags: Denial of service - [Keycloak-services: keycloak-services: fgap v2 composite-blind role mapping allows privilege escalation](https://agentprime.io/advisories/CVE-2026-96448.md) `CVE-2026-96448` · CVE record: Red Hat Red Hat Build of Keycloak and 1 more · CVSS 6.6 Medium · Not analysed yet · Published 25 Sept 2026 · Tags: Broken access control - [Keycloak-services: keycloak-services: standard token exchange v2 bypasses mtls holder-of-key binding](https://agentprime.io/advisories/CVE-2026-97846.md) `CVE-2026-97846` · CVE record: Red Hat Red Hat Build of Keycloak and 1 more · CVSS 6.8 Medium · Not analysed yet · Published 25 Sept 2026 · Tags: Authentication bypass - [Keycloak-services: keycloak-services: admin rest api role-groups endpoint discloses groups without authorization](https://agentprime.io/advisories/CVE-2026-97311.md) `CVE-2026-97311` · CVE record: Red Hat Red Hat Build of Keycloak and 1 more · CVSS 4.3 Medium · Not analysed yet · Published 24 Sept 2026 · Tags: Broken access control - [Keycloak-services: keycloak-services: generic user update bypasses denied reset-password permission](https://agentprime.io/advisories/CVE-2026-97177.md) `CVE-2026-97177` · CVE record: Red Hat Red Hat Build of Keycloak and 1 more · CVSS 6.6 Medium · Not analysed yet · Published 24 Sept 2026 · Tags: Broken access control - [Keycloak-services: keycloak-services: essential acr requirement silently bypassed via cookie authenticator](https://agentprime.io/advisories/CVE-2026-97176.md) `CVE-2026-97176` · CVE record: Red Hat Red Hat Build of Keycloak and 1 more · CVSS 4.2 Medium · Not analysed yet · Published 24 Sept 2026 · Tags: Broken access control - [Keycloak-services: keycloak-services: conditional otp skip-header policy evaluated against untrusted proxy headers](https://agentprime.io/advisories/CVE-2026-96445.md) `CVE-2026-96445` · CVE record: Red Hat Red Hat Build of Keycloak and 1 more · CVSS 6.8 Medium · Not analysed yet · Published 23 Sept 2026 · Tags: Authentication bypass - [Keycloak-services: keycloak-services: par single-use bypass via prompt=none silent authentication path](https://agentprime.io/advisories/CVE-2026-96446.md) `CVE-2026-96446` · CVE record: Red Hat Red Hat Build of Keycloak and 1 more · CVSS 4.2 Medium · Not analysed yet · Published 23 Sept 2026 · Tags: Broken access control - [Keycloak-services: keycloak-services: potential kdc spoofing bypass when kerberos password authentication is enabled](https://agentprime.io/advisories/CVE-2026-95503.md) `CVE-2026-95503` · CVE record: Red Hat Red Hat Build of Keycloak and 1 more · CVSS 6.8 Medium · Not analysed yet · Published 22 Sept 2026 · Tags: Weak cryptography or TLS - [Keycloak-services: keycloak-services: 2fa setup enforcement bypass via authentication session restart endpoint](https://agentprime.io/advisories/CVE-2026-94218.md) `CVE-2026-94218` · CVE record: Red Hat Red Hat Build of Keycloak and 1 more · CVSS 3.1 Low · Not analysed yet · Published 21 Sept 2026 · Tags: Broken access control - [Keycloak-services: keycloak-services: uma scope merge across resource owners via resource name collision](https://agentprime.io/advisories/CVE-2026-94217.md) `CVE-2026-94217` · CVE record: Red Hat Red Hat Build of Keycloak and 1 more · CVSS 3.5 Low · Not analysed yet · Published 21 Sept 2026 · Tags: Broken access control - [Keycloak-services: keycloak-services: cross-realm client read/write via request-level cache missing realm ownership check](https://agentprime.io/advisories/CVE-2026-94215.md) `CVE-2026-94215` · CVE record: Red Hat Red Hat Build of Keycloak and 1 more · CVSS 5.5 Medium · Not analysed yet · Published 21 Sept 2026 · Tags: Broken access control - [Keycloak-services: keycloak-services: authorization services policy evaluation endpoint leaks user identity](https://agentprime.io/advisories/CVE-2026-94213.md) `CVE-2026-94213` · CVE record: Red Hat Red Hat Build of Keycloak and 1 more · CVSS 4.9 Medium · Not analysed yet · Published 21 Sept 2026 · Tags: Broken access control - [Keycloak-services: keycloak-services: admin credential delete bypasses denied reset-password permission](https://agentprime.io/advisories/CVE-2026-94001.md) `CVE-2026-94001` · CVE record: Red Hat Red Hat Build of Keycloak and 1 more · CVSS 6.5 Medium · Not analysed yet · Published 19 Sept 2026 · Tags: Broken access control - [Keycloak-services: keycloak-services: delegated admin with manage-users can escalate to realm-admin via group membership](https://agentprime.io/advisories/CVE-2026-94000.md) `CVE-2026-94000` · CVE record: Red Hat Red Hat Build of Keycloak and 1 more · CVSS 6.6 Medium · Not analysed yet · Published 19 Sept 2026 · Tags: Broken access control - [Keycloak-services: keycloak-services: token refresh continues issuing tokens for disabled audience clients](https://agentprime.io/advisories/CVE-2026-93999.md) `CVE-2026-93999` · CVE record: Red Hat Red Hat Build of Keycloak and 1 more · CVSS 4.2 Medium · Not analysed yet · Published 19 Sept 2026 · Tags: Broken access control - [Io.netty/netty-codec-http: netty: incomplete validation of malformed transfer-encoding allows http request smuggling](https://agentprime.io/advisories/CVE-2026-93562.md) `CVE-2026-93562` · CVE record: Red Hat Red Hat Build of Debezium 3.6 and 4 more · CVSS 6.5 Medium · Not analysed yet · Published 18 Sept 2026 · Tags: CWE-1035 - [Io.netty/netty-codec-http: netty: http request smuggling via post-digit whitespace in chunk-size parsing](https://agentprime.io/advisories/CVE-2026-93574.md) `CVE-2026-93574` · CVE record: Red Hat Red Hat Build of Debezium 3.6 and 4 more · CVSS 6.5 Medium · Not analysed yet · Published 18 Sept 2026 · Tags: HTTP request smuggling - [Io.netty/netty-codec-http2: netty: http/2 header field values are not validated by default (cr/lf/nul passthrough)](https://agentprime.io/advisories/CVE-2026-93579.md) `CVE-2026-93579` · CVE record: Red Hat Red Hat Build of Debezium 3.6 and 4 more · CVSS 6.5 Medium · Not analysed yet · Published 18 Sept 2026 · Tags: CWE-1035 - [Io.netty/netty-codec-http: netty split transfer-encoding fields bypass final-chunked validation and enable request smuggling](https://agentprime.io/advisories/CVE-2026-93573.md) `CVE-2026-93573` · CVE record: Red Hat Red Hat Build of Debezium 3.6 and 4 more · CVSS 6.5 Medium · Not analysed yet · Published 18 Sept 2026 · Tags: HTTP request smuggling - [Io.netty/netty-codec-http2: io.netty/netty-codec-http3: netty: http/2 and http/3 extended connect requests are downgraded as regular connect requests](https://agentprime.io/advisories/CVE-2026-93568.md) `CVE-2026-93568` · CVE record: Red Hat Red Hat Build of Apache Camel 3.33.3.SP2 and 4 more · CVSS 7.5 High · Not analysed yet · Published 18 Sept 2026 · Tags: CWE-20 Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .