# Red Hat Single Sign-On 7. Every CVE that names Red Hat Single Sign-On 7 among its affected products, newest first. Vendors and products are as the CNA wrote them. ## Records, newest first (an older page) - [Keycloak-services: keycloak-services: missing per-role authorization on rolecontainerresource composite endpoints](https://agentprime.io/advisories/CVE-2026-16105.md) `CVE-2026-16105` · CVE record: Red Hat Red Hat build of Keycloak 26.6 and 4 more · CVSS 4.9 Medium · Not analysed yet · Published 31 Jul 2026 · Tags: Broken access control - [Keycloak-services: keycloak-services: microsoft external access-token exchange bypasses configured tenant](https://agentprime.io/advisories/CVE-2026-18215.md) `CVE-2026-18215` · CVE record: Red Hat Red Hat build of Keycloak 26.6 and 4 more · CVSS 6.8 Medium · Not analysed yet · Published 31 Jul 2026 · Tags: Authentication bypass - [Keycloak-services: keycloak-services: saml http-redirect binding response preserves query string leading to parameter pollution](https://agentprime.io/advisories/CVE-2026-18217.md) `CVE-2026-18217` · CVE record: Red Hat Red Hat Build of Keycloak and 3 more · CVSS 3.4 Low · Not analysed yet · Published 31 Jul 2026 · Tags: CWE-20 - [Keycloak-services: keycloak-services: client not-before revocation ignored when realm not-before is older but nonzero](https://agentprime.io/advisories/CVE-2026-18218.md) `CVE-2026-18218` · CVE record: Red Hat Red Hat build of Keycloak 26.6 and 4 more · CVSS 4.2 Medium · Not analysed yet · Published 31 Jul 2026 · Tags: Broken access control - [Keycloak-services: keycloak-services: generic identity-provider creation can bind brokers to organizations without manage-organizations](https://agentprime.io/advisories/CVE-2026-18201.md) `CVE-2026-18201` · CVE record: Red Hat Red Hat build of Keycloak 26.6 and 4 more · CVSS 5.5 Medium · Not analysed yet · Published 29 Jul 2026 · Tags: Broken access control - [Keycloak-services: keycloak-services: client policy source-group condition bypass via duplicate group name matching](https://agentprime.io/advisories/CVE-2026-18207.md) `CVE-2026-18207` · CVE record: Red Hat Red Hat Build of Keycloak and 3 more · CVSS 6.5 Medium · Not analysed yet · Published 29 Jul 2026 · Tags: Broken access control - [Keycloak-services: keycloak-services: information disclosure via role-users endpoint bypasses per-user view filter](https://agentprime.io/advisories/CVE-2026-17059.md) `CVE-2026-17059` · CVE record: Red Hat Red Hat build of Keycloak 26.6 and 4 more · CVSS 6.5 Medium · Not analysed yet · Published 24 Jul 2026 · Tags: Broken access control - [Keycloak-services: keycloak-services: vault-resolved rotated client secrets leaked via admin rest api](https://agentprime.io/advisories/CVE-2026-17048.md) `CVE-2026-17048` · CVE record: Red Hat Red Hat build of Keycloak 26.6 and 4 more · CVSS 5.5 Medium · Not analysed yet · Published 24 Jul 2026 · Tags: Information disclosure - [Keycloak-services: keycloak-services: authenticator config endpoint exposes raw recaptcha secrets to view-only admins](https://agentprime.io/advisories/CVE-2026-16104.md) `CVE-2026-16104` · CVE record: Red Hat Red Hat build of Keycloak 26.6 and 4 more · CVSS 4.3 Medium · Not analysed yet · Published 17 Jul 2026 · Tags: Hard-coded credentials, CWE-212 - [Keycloak-services: keycloak-services: incomplete fix for ciba brute-force lockout bypass at token redemption](https://agentprime.io/advisories/CVE-2026-16103.md) `CVE-2026-16103` · CVE record: Red Hat Red Hat Build of Keycloak and 3 more · CVSS 4.3 Medium · Not analysed yet · Published 17 Jul 2026 · Tags: CWE-305, CWE-841 - [Keycloak-services: keycloak-services: incorrect authorization in admin role-composite deletion allows delegated admin to remove privileged child roles](https://agentprime.io/advisories/CVE-2026-16106.md) `CVE-2026-16106` · CVE record: Red Hat Red Hat build of Keycloak 26.6 and 4 more · CVSS 4.9 Medium · Not analysed yet · Published 17 Jul 2026 · Tags: Broken access control, CWE-1220 - [Keycloak-services: keycloak-services: realm default-group reads disclose hidden groups under fgap v2](https://agentprime.io/advisories/CVE-2026-16108.md) `CVE-2026-16108` · CVE record: Red Hat Red Hat build of Keycloak 26.6 and 4 more · CVSS 4.3 Medium · Not analysed yet · Published 17 Jul 2026 · Tags: Information disclosure, CWE-1220 - [Keycloak-services: keycloak-services: required signed-jwt assertion policy can be bypassed with unsigned assertion headers](https://agentprime.io/advisories/CVE-2026-16093.md) `CVE-2026-16093` · CVE record: Red Hat Red Hat build of Keycloak 26.6 and 4 more · CVSS 5.4 Medium · Not analysed yet · Published 17 Jul 2026 · Tags: CWE-807 - [Keycloak-services: keycloak-services: authorization codes can be retargeted to another client session](https://agentprime.io/advisories/CVE-2026-16089.md) `CVE-2026-16089` · CVE record: Red Hat Red Hat build of Keycloak 26.6 and 4 more · CVSS 5.4 Medium · Not analysed yet · Published 17 Jul 2026 · Tags: Authentication bypass, CWE-472 - [Keycloak-services: keycloak-services: organization invitation link exposure allows unauthorized member creation](https://agentprime.io/advisories/CVE-2026-16072.md) `CVE-2026-16072` · CVE record: Red Hat Red Hat build of Keycloak 26.6 and 4 more · CVSS 4.9 Medium · Not analysed yet · Published 17 Jul 2026 · Tags: Broken access control, Information disclosure - [Keycloak-services: keycloak-services: oidc idp update reuses masked client secret after token url change](https://agentprime.io/advisories/CVE-2026-15943.md) `CVE-2026-15943` · CVE record: Red Hat Red Hat Build of Keycloak and 3 more · CVSS 5.5 Medium · Not analysed yet · Published 17 Jul 2026 · Tags: CWE-1288 - [Keycloak-services: keycloak-services: group hierarchy search discloses hidden parent groups under fgap v2](https://agentprime.io/advisories/CVE-2026-15945.md) `CVE-2026-15945` · CVE record: Red Hat Red Hat build of Keycloak 26.6 and 4 more · CVSS 4.3 Medium · Not analysed yet · Published 16 Jul 2026 · Tags: Broken access control - [Keycloak-services: keycloak-services: oidc email_verified claim incorrectly applied to userinfo email](https://agentprime.io/advisories/CVE-2026-14781.md) `CVE-2026-14781` · CVE record: Red Hat Red Hat Build of Keycloak and 3 more · CVSS 4.8 Medium · Not analysed yet · Published 5 Jul 2026 · Tags: CWE-1288 - [Keycloak-services: keycloak-services: fgap v2 client scope assignment bypass via clientresource](https://agentprime.io/advisories/CVE-2026-14614.md) `CVE-2026-14614` · CVE record: Red Hat Red Hat build of Keycloak 26.4 and 4 more · CVSS 5.4 Medium · Not analysed yet · Published 3 Jul 2026 · Tags: Broken access control - [Keycloak-services: keycloak-services: keycloak: fgap v2 role groups endpoint discloses hidden group metadata without group view permission](https://agentprime.io/advisories/CVE-2026-14613.md) `CVE-2026-14613` · CVE record: Red Hat Red Hat build of Keycloak 26.6 and 4 more · CVSS 4.3 Medium · Not analysed yet · Published 3 Jul 2026 · Tags: Broken access control, CWE-1220 - [Keycloak-services: blind server-side request forgery (ssrf) via http redirect handling in keycloak](https://agentprime.io/advisories/CVE-2026-4366.md) `CVE-2026-4366` · CVE record: Red Hat Red Hat build of Keycloak 26.4 and 4 more · CVSS 5.8 Medium · Not analysed yet · Published 18 Mar 2026 · Tags: Server-side request forgery (SSRF) - [Rhsso: open redirect](https://agentprime.io/advisories/CVE-2025-12789.md) `CVE-2025-12789` · CVE record: Red Hat Red Hat Single Sign-On 7 · CVSS 6.1 Medium · Not analysed yet · Published 6 Nov 2025 · Tags: Open redirect - [Wildfly: wildfly vulnerable to cross-site scripting (xss)](https://agentprime.io/advisories/CVE-2024-10234.md) `CVE-2024-10234` · CVE record: Red Hat Red Hat JBoss Enterprise Application Platform 7 and 4 more · CVSS 6.1 Medium · Not analysed yet · Published 22 Oct 2024 · Tags: Cross-site scripting (XSS) - [Undertow: ajp request closes connection exceeding maxrequestsize](https://agentprime.io/advisories/CVE-2023-5379.md) `CVE-2023-5379` · CVE record: Red Hat Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 and 4 more · CVSS 7.5 High · Not analysed yet · Published 12 Dec 2023 · Tags: Denial of service - [Rhsso-container-image: unsecured management interface exposed to adjecent network](https://agentprime.io/advisories/CVE-2022-4039.md) `CVE-2022-4039` · CVE record: Red Hat RHEL-8 based Middleware Containers and 1 more · CVSS 8.0 High · Not analysed yet · Published 22 Sept 2023 · Tags: Broken access control Newest: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .