What’s Vulnerable › Products
Red Hat Single Sign-On vulnerabilities
112 known vulnerabilities, 1 confirmed exploited in the wild (CISA KEV), 15 published in the last 12 months.
Check whether your Red Hat Single Sign-On version is affected
Exploited Red Hat Single Sign-On vulnerabilities
- CVE-2023-44487 — HTTP/2 Rapid Reset Attack Vulnerability
Latest Red Hat Single Sign-On vulnerabilities
- CVE-2026-16102 — Keycloak-services: keycloak-services: default dcr policy allows role forgery via user property mappers (CVSS 8.1)
- CVE-2026-15573 — Keycloak-services: keycloak-services: authorization bypass via unnormalized uri matching in pathmatcher (CVSS 8.1)
- CVE-2026-16093 — Keycloak-services: keycloak-services: required signed-jwt assertion policy can be bypassed with unsigned assertion headers (CVSS 5.4)
- CVE-2026-15945 — Keycloak-services: keycloak-services: group hierarchy search discloses hidden parent groups under fgap v2 (CVSS 2.7)
- CVE-2026-49875 — Apache CXF: XML External Entity (XXE) Injection in W3CMultiSchemaFactory and EndpointReferenceUtils (CVSS 9.8)
- CVE-2026-28369 — Undertow: undertow: request smuggling via malformed http request headers (CVSS 9.1)
- CVE-2026-28368 — Undertow: undertow: request smuggling via inconsistent header parsing (CVSS 9.1)
- CVE-2026-28367 — Undertow: undertow: request smuggling via `\r\r\r` as a header block terminator (CVSS 9.1)
- CVE-2026-3121 — Keycloak: org.keycloak/keycloak-services: keycloak: privilege escalation via manage-clients permission (CVSS 7.2)
- CVE-2026-4874 — Org.keycloak.protocol.oidc.grants: org.keycloak.services.managers: keycloak: server-side request forgery via oidc token endpoint manipulation (CVSS 3.1)
- CVE-2026-4366 — Keycloak-services: blind server-side request forgery (ssrf) via http redirect handling in keycloak (CVSS 5.8)
- CVE-2026-3009 — Org.keycloak/keycloak-services: improper enforcement of disabled identity provider in identitybrokerservice (authentication bypass) (CVSS 8.1)
- CVE-2025-12543 — Undertow-core: undertow http server fails to reject malformed host headers leading to potential cache poisoning and ssrf (CVSS 9.6)
- CVE-2025-9784 — Undertow: undertow madeyoureset http/2 ddos vulnerability (CVSS 7.5)
- CVE-2023-1932 — Hibernate-validator: rendering of invalid html with safehtml leads to html injection and xss (CVSS 6.1)
- CVE-2024-8883 — Keycloak: vulnerable redirect uri validation results in open redirec (CVSS 6.1)
- CVE-2023-6841 — Keycloak: amount of attributes per object is not limited and it may lead to dos (CVSS 7.5)
- CVE-2024-7341 — Wildfly-elytron: org.keycloak/keycloak-services: session fixation in elytron saml adapters (CVSS 7.1)
- CVE-2024-4629 — Keycloak: potential bypass of brute force protection (CVSS 6.5)
- CVE-2024-7885 — Undertow: improper state management in proxy protocol parsing causes information leakage (CVSS 7.5)
- CVE-2024-1132 — Keycloak: path transversal in redirection validation (CVSS 8.1)
- CVE-2024-1635 — Undertow: out-of-memory error after several closed connections with wildfly-http-client protocol (CVSS 7.5)
- CVE-2023-6291 — Keycloak: redirect_uri validation bypass (CVSS 7.1)
- CVE-2023-2585 — Keycloak: client access via device auth request spoof (CVSS 8.1)
- CVE-2023-6927 — Keycloak: open redirect via "form_post.jwt" jarm response mode (CVSS 6.1)