What’s Vulnerable › Products
Red Hat build of Keycloak 26.4 vulnerabilities
220 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 186 published in the last 12 months.
Check whether your Red Hat build of Keycloak 26.4 version is affected
Latest Red Hat build of Keycloak 26.4 vulnerabilities
- CVE-2026-118959 — Keycloak-services: keycloak-services: required actions bypassed via kc_action parameter (CVSS 5.4)
- CVE-2026-118947 — Keycloak-services: keycloak-services: authorization bypass via uma resource registration idor (CVSS 4.3)
- CVE-2026-118425 — Keycloak-services: keycloak-services: redirect uri domain allowlist bypass via dns resolution to loopback (CVSS 6.8)
- CVE-2026-118030 — Keycloak-services: keycloak-services: hotp race condition allows single otp code reuse across concurrent logins (CVSS 4.2)
- CVE-2026-117859 — Keycloak-services: keycloak-services: par single-use bypass via flow restart (CVSS 5.4)
- CVE-2026-117688 — Keycloak-services: keycloak-services: vault secret disclosure via client registration installation configuration (CVSS 5.3)
- CVE-2026-117627 — Keycloak-services: keycloak-services: jwt authorization grant bypasses identity provider login restrictions (CVSS 5.4)
- CVE-2026-114438 — Keycloak-services: keycloak-services: required otp enrollment bypassed via update user locale required action ordering (CVSS 4.2)
- CVE-2026-109082 — Keycloak-services: keycloak-services: ciba confidential-only contract not enforced for public clients (CVSS 6.8)
- CVE-2026-107889 — Keycloak-services: keycloak-services: stored xss on login page via kcsanitize bypass (CVSS 5.5)
- CVE-2026-107623 — Keycloak-services: keycloak-services: oidc dcr read-modify-write silently disables offline token revocation (CVSS 4.3)
- CVE-2026-107604 — Keycloak-services: keycloak-services: view-clients role allows retrieval of active client secrets via installation provider endpoints (CVSS 4.9)
- CVE-2026-107121 — Keycloak-services: keycloak-services: smtp starttls plaintext credential and message downgrade (CVSS 6.5)
- CVE-2026-105305 — Keycloak-services: keycloak-services: device authorization grant bypasses per-client minimum.acr.value enforcement (CVSS 5.4)
- CVE-2026-105306 — Keycloak-services: keycloak-services: token introspection audience bypass via dynamic client registration (CVSS 6.5)
- CVE-2026-105302 — Keycloak-services: keycloak-services: user session note mapper exposes upstream idp access tokens (CVSS 5.7)
- CVE-2026-103884 — Keycloak-services: keycloak-services: path traversal in x.509 crl distribution point allows arbitrary local file read (CVSS 6.5)
- CVE-2026-101333 — Keycloak-services: keycloak-services: unbounded metric series creation via idp tag on broker login endpoint (CVSS 3.7)
- CVE-2026-96448 — Keycloak-services: keycloak-services: fgap v2 composite-blind role mapping allows privilege escalation (CVSS 6.6)
- CVE-2026-97846 — Keycloak-services: keycloak-services: standard token exchange v2 bypasses mtls holder-of-key binding (CVSS 6.8)
- CVE-2026-97311 — Keycloak-services: keycloak-services: admin rest api role-groups endpoint discloses groups without authorization (CVSS 4.3)
- CVE-2026-97177 — Keycloak-services: keycloak-services: generic user update bypasses denied reset-password permission (CVSS 6.6)
- CVE-2026-97176 — Keycloak-services: keycloak-services: essential acr requirement silently bypassed via cookie authenticator (CVSS 4.2)
- CVE-2026-96446 — Keycloak-services: keycloak-services: par single-use bypass via prompt=none silent authentication path (CVSS 4.2)
- CVE-2026-96445 — Keycloak-services: keycloak-services: conditional otp skip-header policy evaluated against untrusted proxy headers (CVSS 6.8)