Vulnérabilités connues pour Red Hat Build of Keycloak

Votre version est-elle touchée ?

Liste des CVE

CVE	Résumé	Score	Publiée
CVE-2026-107123	Keycloak-services: keycloak-services: unauthenticated cpu denial of service via saml xml datetime and duration parsing	7.5 Élevée	5 nov. 2026
CVE-2026-117691	Keycloak-services: keycloak-services: saml redirect binding signature bypass via percent-encoded parameter names	9.1 Critique	5 nov. 2026
CVE-2026-107912	Io.quarkus/quarkus-vertx-http: quarkus-vertx-http: authorization bypass in management interface via path concatenation flaw	7.7 Élevée	5 nov. 2026
CVE-2026-120971	A flaw was found in RESTEasy's default exception mapper	5.3 Moyenne	3 nov. 2026
CVE-2026-118959	A flaw was found in the required action provider mechanism of Keycloak	5.4 Moyenne	30 oct. 2026
CVE-2026-118947	Keycloak-services: keycloak-services: authorization bypass via uma resource registration idor	4.3 Moyenne	30 oct. 2026
CVE-2026-118425	A flaw was found in the secure-redirect-uris-enforcer client policy of Keycloak, an identity and access management…	6.8 Moyenne	29 oct. 2026
CVE-2026-117859	A flaw was found in the Pushed Authorization Request PAR implementation of the keycloak-services component	5.4 Moyenne	29 oct. 2026
CVE-2026-118030	Keycloak-services: keycloak-services: hotp race condition allows single otp code reuse across concurrent logins	4.2 Moyenne	29 oct. 2026
CVE-2026-117688	A flaw was found in the client registration component of Keycloak, an open-source identity and access management…	5.3 Moyenne	29 oct. 2026
CVE-2026-117627	A flaw was found in the JWT Authorization Grant implementation of the keycloak-services component	5.4 Moyenne	29 oct. 2026
CVE-2026-114438	A flaw was found in the Update User Locale required action of the Keycloak identity and access management solution	4.2 Moyenne	21 oct. 2026
CVE-2026-109082	A flaw was found in the Client-Initiated Backchannel Authentication CIBA implementation within the keycloak-services…	6.8 Moyenne	12 oct. 2026
CVE-2026-107889	Keycloak-services: keycloak-services: stored xss on login page via kcsanitize bypass	5.5 Moyenne	9 oct. 2026
CVE-2026-107623	Keycloak-services: keycloak-services: oidc dcr read-modify-write silently disables offline token revocation	4.3 Moyenne	8 oct. 2026
CVE-2026-107604	A flaw was found in the installation provider and client registration endpoints of the Keycloak identity management…	4.9 Moyenne	8 oct. 2026
CVE-2026-107121	Keycloak-services: keycloak-services: smtp starttls plaintext credential and message downgrade	6.5 Moyenne	7 oct. 2026
CVE-2026-105305	Keycloak-services: keycloak-services: device authorization grant bypasses per-client minimum.acr.value enforcement	5.4 Moyenne	6 oct. 2026
CVE-2026-105306	A flaw was found in the Dynamic Client Registration flow of the Keycloak identity and access management server	6.5 Moyenne	5 oct. 2026
CVE-2026-105302	A flaw was found in the User Session Note mapper of the Keycloak identity and access management solution	5.7 Moyenne	5 oct. 2026
CVE-2026-105301	A flaw was found in the X.509 client-certificate authenticator of Keycloak, a solution for identity and access…	4.0 Moyenne	5 oct. 2026
CVE-2026-103884	Keycloak-services: keycloak-services: path traversal in x.509 crl distribution point allows arbitrary local file read	6.5 Moyenne	1 oct. 2026
CVE-2026-101333	Keycloak-services: keycloak-services: unbounded metric series creation via idp tag on broker login endpoint	3.7 Faible	28 sept. 2026
CVE-2026-96448	Keycloak-services: keycloak-services: fgap v2 composite-blind role mapping allows privilege escalation	6.6 Moyenne	25 sept. 2026
CVE-2026-97846	Keycloak-services: keycloak-services: standard token exchange v2 bypasses mtls holder-of-key binding	6.8 Moyenne	25 sept. 2026

Autres produits Red Hat