Red Hat Build of Keycloak
- Software type
- Software application
- Total vulnerabilities (90 days)
- Products & ServicesProducts & Services
- SolutionsSolutions
- PricingPricing
- CompanyCompany
- ResourcesResources
en
en
A short verification protects source data and prevents automated AI requests.
Verifying...
As of 11/08/2026, Red Hat Build of Keycloak recorded 76 security vulnerabilities in the last 90 days, of which 28 are rated High or Critical. None of these vulnerabilities is actively exploited (KEV) according to CISA's catalog. CyStack recommends that organizations and individual users apply patches as soon as possible.
CyStack does not yet have sufficient official-source data to identify the latest version of Red Hat Build of Keycloak and determine which vulnerabilities affect that version.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
CVE-2026-120984Keycloak-services: keycloak-services: manage-clients to arbitrary code execution through inline javascript policy importCVE-2026-9797Keycloak: keycloak: privilege escalation via client authentication manipulation by an authenticated administratorCVE-2026-97847Keycloak-services: keycloak-services: client manager can substitute sessionless token principal via hardcoded-claim mappers to obtain realm administrator authorityCVE-2026-97175Keycloak-services: keycloak-services: unverified idp email auto-linking enables account takeoverCVE-2026-97174Keycloak-services: keycloak-services: ciba sub parameter injection causes attacker authentication to issue victim tokens| Vulnerability | Exploitation status | Fix | Published | Severity |
|---|---|---|---|---|
CVE-2026-120984Keycloak-services: keycloak-services: manage-clients to arbitrary code execution through inline javascript policy import | Exploitation statusNot confirmed | FixNo |
| SeverityCritical |
CVE-2026-9797Keycloak: keycloak: privilege escalation via client authentication manipulation by an authenticated administrator | Exploitation statusNot confirmed | FixNo | Published11/06/2026 | SeverityMedium |
|---|
CVE-2026-97847Keycloak-services: keycloak-services: client manager can substitute sessionless token principal via hardcoded-claim mappers to obtain realm administrator authority | Exploitation statusNot confirmed | FixNo | Published11/05/2026 | SeverityHigh |
|---|
CVE-2026-97175Keycloak-services: keycloak-services: unverified idp email auto-linking enables account takeover | Exploitation statusNot confirmed | FixNo | Published11/05/2026 | SeverityHigh |
|---|
CVE-2026-97174Keycloak-services: keycloak-services: ciba sub parameter injection causes attacker authentication to issue victim tokens | Exploitation statusNot exploited | FixNo | Published11/05/2026 | SeverityMedium |
|---|
CVE-2026-96453Org.keycloak/keycloak-admin-cli: keycloak-admin-cli: kcadm custom truststore accepts arbitrary self-signed certificates | Exploitation statusNot confirmed | FixNo | Published11/05/2026 | SeverityHigh |
|---|
CVE-2026-93998Keycloak-core: keycloak-core: saml adapter does not bind signed assertions to the configured identity provider issuer | Exploitation statusNot exploited | FixNo | Published11/05/2026 | SeverityHigh |
|---|
CVE-2026-92857Keycloak-services: keycloak-services: dcr protocol mapper config not validated, allowing iat holders to forge sub and aud claims in signed tokens | Exploitation statusNot confirmed | FixNo | Published11/05/2026 | SeverityHigh |
|---|
CVE-2026-92855Keycloak-services: keycloak-services: saml broker accepts holder-of-key assertions without proof of key possession | Exploitation statusNot confirmed | FixNo | Published11/05/2026 | SeverityHigh |
|---|
CVE-2026-82965Keycloak-services: keycloak-services: unauthenticated denial of service via saml soap endpoint unbounded xml parsing | Exploitation statusNot exploited | FixNo | Published11/05/2026 | SeverityHigh |
|---|
CVE-2026-117691SAML signature bypass enables federated account takeover in Red Hat Build of Keycloak | Exploitation statusNot exploited | FixNo | Published11/05/2026 | SeverityCritical |
|---|
CVE-2026-114232Keycloak-services: keycloak-services: uma protection api resourcetype field not validated — cross-owner resource access | Exploitation statusNot exploited | FixNo | Published11/05/2026 | SeverityHigh |
|---|
CVE-2026-112208Keycloak-services: keycloak-services: account takeover via stale sso_auth note in organization identity-first login | Exploitation statusNot confirmed | FixNo | Published11/05/2026 | SeverityHigh |
|---|
CVE-2026-110932Keycloak-services: keycloak-services: unauthenticated persistent disk exhaustion via theme gzip cache | Exploitation statusNot exploited | FixNo | Published11/05/2026 | SeverityHigh |
|---|
CVE-2026-110931Keycloak-services: keycloak-services: unauthenticated jvm termination via saml 1.1 authoritybinding parsing loop | Exploitation statusNot confirmed | FixNo | Published11/05/2026 | SeverityHigh |
|---|
CVE-2026-107912Io.quarkus/quarkus-vertx-http: quarkus-vertx-http: authorization bypass in management interface via path concatenation flaw | Exploitation statusNot confirmed | FixNo | Published11/05/2026 | SeverityHigh |
|---|
CVE-2026-107602Keycloak-services: keycloak-services: unauthenticated cpu exhaustion via saml 1.1 keyinfo infinite loop | Exploitation statusNot confirmed | FixNo | Published11/05/2026 | SeverityHigh |
|---|
CVE-2026-107123Keycloak-services: keycloak-services: unauthenticated cpu denial of service via saml xml datetime and duration parsing | Exploitation statusNot exploited | FixNo | Published11/05/2026 | SeverityHigh |
|---|
CVE-2026-103112Keycloak-services: keycloak-services: account takeover via authentication race using reset-credentials path | Exploitation statusNot confirmed | FixNo | Published11/05/2026 | SeverityHigh |
|---|
CVE-2026-120971Org.jboss.resteasy/resteasy-core: resteasy: information disclosure through default exception mapper responses | Exploitation statusNot exploited | FixNo | Published11/03/2026 | SeverityMedium |
|---|
CVE-2026-118959Keycloak-services: keycloak-services: required actions bypassed via kc_action parameter | Exploitation statusNot exploited | FixNo | Published10/30/2026 | SeverityMedium |
|---|
CVE-2026-118947Keycloak-services: keycloak-services: authorization bypass via uma resource registration idor | Exploitation statusNot exploited | FixNo | Published10/30/2026 | SeverityMedium |
|---|
CVE-2026-118425Keycloak-services: keycloak-services: redirect uri domain allowlist bypass via dns resolution to loopback | Exploitation statusNot exploited | FixNo | Published10/29/2026 | SeverityMedium |
|---|
CVE-2026-118030Keycloak-services: keycloak-services: hotp race condition allows single otp code reuse across concurrent logins | Exploitation statusNot exploited | FixNo | Published10/29/2026 | SeverityMedium |
|---|
CVE-2026-117859Keycloak-services: keycloak-services: par single-use bypass via flow restart | Exploitation statusNot exploited | FixNo | Published10/29/2026 | SeverityMedium |
|---|
CVE-2026-117688Keycloak-services: keycloak-services: vault secret disclosure via client registration installation configuration | Exploitation statusNot exploited | FixNo | Published10/29/2026 | SeverityMedium |
|---|
CVE-2026-117627Keycloak-services: keycloak-services: jwt authorization grant bypasses identity provider login restrictions | Exploitation statusNot exploited | FixNo | Published10/29/2026 | SeverityMedium |
|---|
CVE-2026-114438Keycloak-services: keycloak-services: required otp enrollment bypassed via update user locale required action ordering | Exploitation statusNot exploited | FixNo | Published10/21/2026 | SeverityMedium |
|---|
CVE-2026-109082Keycloak-services: keycloak-services: ciba confidential-only contract not enforced for public clients | Exploitation statusNot exploited | FixNo | Published10/12/2026 | SeverityMedium |
|---|
CVE-2026-107889Keycloak-services: keycloak-services: stored xss on login page via kcsanitize bypass | Exploitation statusNot exploited | FixNo | Published10/09/2026 | SeverityMedium |
|---|
CVE-2026-107623Keycloak-services: keycloak-services: oidc dcr read-modify-write silently disables offline token revocation | Exploitation statusNot exploited | FixNo | Published10/08/2026 | SeverityMedium |
|---|
CVE-2026-107604Keycloak-services: keycloak-services: view-clients role allows retrieval of active client secrets via installation provider endpoints | Exploitation statusNot exploited | FixNo | Published10/08/2026 | SeverityMedium |
|---|
CVE-2026-107121Keycloak-services: keycloak-services: smtp starttls plaintext credential and message downgrade | Exploitation statusNot exploited | FixNo | Published10/07/2026 | SeverityMedium |
|---|
CVE-2026-105305Keycloak-services: keycloak-services: device authorization grant bypasses per-client minimum.acr.value enforcement | Exploitation statusNot exploited | FixNo | Published10/06/2026 | SeverityMedium |
|---|
CVE-2026-105306Keycloak-services: keycloak-services: token introspection audience bypass via dynamic client registration | Exploitation statusNot exploited | FixNo | Published10/05/2026 | SeverityMedium |
|---|
CVE-2026-105302Keycloak-services: keycloak-services: user session note mapper exposes upstream idp access tokens | Exploitation statusNot exploited | FixNo | Published10/05/2026 | SeverityMedium |
|---|
CVE-2026-103884Keycloak-services: keycloak-services: path traversal in x.509 crl distribution point allows arbitrary local file read | Exploitation statusNot exploited | FixNo | Published10/01/2026 | SeverityMedium |
|---|
CVE-2026-101333Keycloak-services: keycloak-services: unbounded metric series creation via idp tag on broker login endpoint | Exploitation statusNot exploited | FixNo | Published09/28/2026 | SeverityLow |
|---|
CVE-2026-97846Keycloak-services: keycloak-services: standard token exchange v2 bypasses mtls holder-of-key binding | Exploitation statusNot exploited | FixNo | Published09/25/2026 | SeverityMedium |
|---|
CVE-2026-96448Keycloak-services: keycloak-services: fgap v2 composite-blind role mapping allows privilege escalation | Exploitation statusNot exploited | FixNo | Published09/25/2026 | SeverityMedium |
|---|
CVE-2026-97311Keycloak-services: keycloak-services: admin rest api role-groups endpoint discloses groups without authorization | Exploitation statusNot exploited | FixNo | Published09/24/2026 | SeverityMedium |
|---|
CVE-2026-97177Keycloak-services: keycloak-services: generic user update bypasses denied reset-password permission | Exploitation statusNot exploited | FixNo | Published09/24/2026 | SeverityMedium |
|---|
CVE-2026-97176Keycloak-services: keycloak-services: essential acr requirement silently bypassed via cookie authenticator | Exploitation statusNot exploited | FixNo | Published09/24/2026 | SeverityMedium |
|---|
CVE-2026-96446Keycloak-services: keycloak-services: par single-use bypass via prompt=none silent authentication path | Exploitation statusNot exploited | FixNo | Published09/23/2026 | SeverityMedium |
|---|
CVE-2026-96445Keycloak-services: keycloak-services: conditional otp skip-header policy evaluated against untrusted proxy headers | Exploitation statusNot exploited | FixNo | Published09/23/2026 | SeverityMedium |
|---|
CVE-2026-95503Keycloak-services: keycloak-services: potential kdc spoofing bypass when kerberos password authentication is enabled | Exploitation statusNot exploited | FixNo | Published09/22/2026 | SeverityMedium |
|---|
CVE-2026-94218Keycloak-services: keycloak-services: 2fa setup enforcement bypass via authentication session restart endpoint | Exploitation statusNot exploited | FixNo | Published09/21/2026 | SeverityLow |
|---|
CVE-2026-94217Keycloak-services: keycloak-services: uma scope merge across resource owners via resource name collision | Exploitation statusNot exploited | FixNo | Published09/21/2026 | SeverityLow |
|---|
CVE-2026-94215Keycloak-services: keycloak-services: cross-realm client read/write via request-level cache missing realm ownership check | Exploitation statusNot exploited | FixNo | Published09/21/2026 | SeverityMedium |
|---|
CVE-2026-94213Keycloak-services: keycloak-services: authorization services policy evaluation endpoint leaks user identity | Exploitation statusNot exploited | FixNo | Published09/21/2026 | SeverityMedium |
|---|
109 Results | Page 1 of 3