Known vulnerabilities in Red Hat Build of Keycloak

Is your version affected?

CVE list

CVE	Summary	Score	Published
CVE-2026-107123	Keycloak-services: keycloak-services: unauthenticated cpu denial of service via saml xml datetime and duration parsing	7.5 High	Nov 5, 2026
CVE-2026-117691	Keycloak-services: keycloak-services: saml redirect binding signature bypass via percent-encoded parameter names	9.1 Critical	Nov 5, 2026
CVE-2026-107912	Io.quarkus/quarkus-vertx-http: quarkus-vertx-http: authorization bypass in management interface via path concatenation flaw	7.7 High	Nov 5, 2026
CVE-2026-120971	A flaw was found in RESTEasy's default exception mapper	5.3 Medium	Nov 3, 2026
CVE-2026-118959	A flaw was found in the required action provider mechanism of Keycloak	5.4 Medium	Oct 30, 2026
CVE-2026-118947	Keycloak-services: keycloak-services: authorization bypass via uma resource registration idor	4.3 Medium	Oct 30, 2026
CVE-2026-118425	A flaw was found in the secure-redirect-uris-enforcer client policy of Keycloak, an identity and access management…	6.8 Medium	Oct 29, 2026
CVE-2026-117859	A flaw was found in the Pushed Authorization Request PAR implementation of the keycloak-services component	5.4 Medium	Oct 29, 2026
CVE-2026-118030	Keycloak-services: keycloak-services: hotp race condition allows single otp code reuse across concurrent logins	4.2 Medium	Oct 29, 2026
CVE-2026-117688	A flaw was found in the client registration component of Keycloak, an open-source identity and access management…	5.3 Medium	Oct 29, 2026
CVE-2026-117627	A flaw was found in the JWT Authorization Grant implementation of the keycloak-services component	5.4 Medium	Oct 29, 2026
CVE-2026-114438	A flaw was found in the Update User Locale required action of the Keycloak identity and access management solution	4.2 Medium	Oct 21, 2026
CVE-2026-109082	A flaw was found in the Client-Initiated Backchannel Authentication CIBA implementation within the keycloak-services…	6.8 Medium	Oct 12, 2026
CVE-2026-107889	Keycloak-services: keycloak-services: stored xss on login page via kcsanitize bypass	5.5 Medium	Oct 9, 2026
CVE-2026-107623	Keycloak-services: keycloak-services: oidc dcr read-modify-write silently disables offline token revocation	4.3 Medium	Oct 8, 2026
CVE-2026-107604	A flaw was found in the installation provider and client registration endpoints of the Keycloak identity management…	4.9 Medium	Oct 8, 2026
CVE-2026-107121	Keycloak-services: keycloak-services: smtp starttls plaintext credential and message downgrade	6.5 Medium	Oct 7, 2026
CVE-2026-105305	Keycloak-services: keycloak-services: device authorization grant bypasses per-client minimum.acr.value enforcement	5.4 Medium	Oct 6, 2026
CVE-2026-105306	A flaw was found in the Dynamic Client Registration flow of the Keycloak identity and access management server	6.5 Medium	Oct 5, 2026
CVE-2026-105302	A flaw was found in the User Session Note mapper of the Keycloak identity and access management solution	5.7 Medium	Oct 5, 2026
CVE-2026-105301	A flaw was found in the X.509 client-certificate authenticator of Keycloak, a solution for identity and access…	4.0 Medium	Oct 5, 2026
CVE-2026-103884	Keycloak-services: keycloak-services: path traversal in x.509 crl distribution point allows arbitrary local file read	6.5 Medium	Oct 1, 2026
CVE-2026-101333	Keycloak-services: keycloak-services: unbounded metric series creation via idp tag on broker login endpoint	3.7 Low	Sep 28, 2026
CVE-2026-96448	Keycloak-services: keycloak-services: fgap v2 composite-blind role mapping allows privilege escalation	6.6 Medium	Sep 25, 2026
CVE-2026-97846	Keycloak-services: keycloak-services: standard token exchange v2 bypasses mtls holder-of-key binding	6.8 Medium	Sep 25, 2026

Other Red Hat products