Red Hat Red Hat Build Of Keycloak 26.4
79 CVEs affecting Red Hat Red Hat Build Of Keycloak 26.4. Latest disclosed: 2026-08-05. Critical: 0, High: 23.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-15572 | High | 8.8 | 2026-08-05 | A flaw was found in Keycloak's Dynamic Client Registration (DCR) security policy management. The "Allowed Protocol Mapper Types" policy, which restricts which… |
CVE-2026-3047 | High | 8.8 | 2026-03-05 | A flaw was found in org.keycloak.broker.saml. When a disabled Security Assertion Markup Language (SAML) client is configured as an Identity Provider (IdP)-init… |
CVE-2026-1486 | High | 8.8 | 2026-02-09 | A flaw was found in Keycloak. A vulnerability exists in the jwt-authorization-grant flow where the server fails to verify if an Identity Provider (IdP) is enab… |
CVE-2026-16102 | High | 8.1 | 2026-08-05 | A flaw was found in the Dynamic Client Registration (DCR) component of Keycloak, an identity and access management solution. The default DCR policy fails to pr… |
CVE-2026-15573 | High | 8.1 | 2026-08-05 | A flaw was found in Keycloak's Authorization Services. The component responsible for matching request paths to security policies (PathMatcher) does not properl… |
CVE-2026-9800 | High | 8.1 | 2026-06-25 | A flaw was found in Keycloak Policy Enforcer. This vulnerability allows any authenticated user to bypass all authorization policies, including role, scope, and… |
CVE-2026-7504 | High | 8.1 | 2026-05-19 | A flaw was found in Keycloak's URL validation logic during redirect operations. By crafting a malicious request, an attacker could bypass validation to redirec… |
CVE-2026-4636 | High | 8.1 | 2026-04-02 | A flaw was found in Keycloak. An authenticated user with the uma_protection role can bypass User-Managed Access (UMA) policy validation. This allows the attack… |
CVE-2026-2603 | High | 8.1 | 2026-03-18 | A flaw was found in Keycloak. A remote attacker could bypass security controls by sending a valid SAML response from an external Identity Provider (IdP) to the… |
CVE-2026-3009 | High | 8.1 | 2026-03-05 | A security flaw in the IdentityBrokerService.performLogin endpoint of Keycloak allows authentication to proceed using an Identity Provider (IdP) even after it… |
CVE-2026-1529 | High | 8.1 | 2026-02-09 | A flaw was found in Keycloak. An attacker can exploit this vulnerability by modifying the organization ID and target email within a legitimate invitation token… |
CVE-2026-9099 | High | 7.7 | 2026-06-25 | A flaw was found in Keycloak. A missing authorization check in the GroupResource.addChild() endpoint within the Admin REST API allows an authenticated user wit… |
CVE-2026-2092 | High | 7.7 | 2026-03-18 | A flaw was found in Keycloak. Keycloak's Security Assertion Markup Language (SAML) broker endpoint does not properly validate encrypted assertions when the ove… |
CVE-2026-7507 | High | 7.5 | 2026-05-19 | A session fixation vulnerability was found in Keycloak's login-actions endpoints. An unauthenticated attacker could exploit this flaw by pre-creating an authen… |
CVE-2026-7307 | High | 7.5 | 2026-05-19 | A flaw was found in Keycloak. A remote, unauthenticated attacker can send a specially crafted XML input to the Security Assertion Markup Language (SAML) endpoi… |
CVE-2026-4634 | High | 7.5 | 2026-04-02 | A flaw was found in Keycloak. An unauthenticated attacker can exploit this vulnerability by sending a specially crafted POST request with an excessively long s… |
CVE-2026-16442 | High | 7.4 | 2026-08-05 | A flaw was found in the SAML broker component of Keycloak, which is used to manage identity federation and user authentication. The issue occurs because the Id… |
CVE-2026-16443 | High | 7.4 | 2026-08-05 | A flaw was found in the SAML metadata import functionality of the keycloak-services component, which is the core engine for identity brokering in Red Hat Build… |
CVE-2026-4282 | High | 7.4 | 2026-04-02 | A flaw was found in Keycloak. The SingleUseObjectProvider, a global key-value store, lacks proper type and namespace isolation. This vulnerability allows an un… |
CVE-2026-9086 | High | 7.3 | 2026-06-25 | A flaw was found in Keycloak. A remote attacker with administrative privileges, specifically those with `manage-client` permission or access to client registra… |