Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Red Hat build of Keycloak 26.6.8 — Vulnerabilities & Security Advisories 41

All 41 CVE vulnerabilities found in Red Hat build of Keycloak 26.6.8, with AI-generated Chinese analysis, references, and POCs.

This page aggregates confirmed security weaknesses specifically affecting the Red Hat build of Keycloak 26.6.8, an identity and access management server. The collection encompasses a broad spectrum of reported flaws, ranging from authentication bypasses and cryptographic errors to input validation issues, covering the entire release lifecycle from the initial version launch through all subsequent security updates for this specific minor release line. Visitors can utilize this resource to track official vendor advisories, analyze the prevalence and impact of specific weakness classes within the Keycloak ecosystem, or review the complete historical vulnerability record for this product version. The data presented is derived directly from public security bulletins and verified vulnerability databases, ensuring accuracy without speculative entries. By centralizing these critical security details, the page enables security professionals to assess risk exposure, prioritize patching efforts, and maintain compliance with organizational security standards. This comprehensive view supports effective vulnerability management by providing a single, authoritative source for understanding the security posture of Red Hat build of Keycloak 26.6.8 across its deployment history. Users seeking detailed technical analysis or remediation guidance will find relevant context for each listed issue, facilitating informed decision-making regarding system hardening and upgrade strategies.

Vendor: Red Hat

CVE ID Title CVSS Severity Published
CVE-2026-96460 Keycloak-services: keycloak-services: indefinite access token renewal via standard token exchange v2 CWE-303 5.4 Medium 2026-11-06
CVE-2026-92856 Keycloak-services: keycloak-services: saml broker ignores proxyrestriction delegation constraints CWE-862 4.9 Medium 2026-11-06
CVE-2026-19688 Keycloak-services: keycloak-services: admin api missing audience check CWE-287 6.8 Medium 2026-11-06
CVE-2026-96447 Keycloak-services: keycloak-services: stateless token preferred_username fallback enables identity rebinding CWE-287 4.2 Medium 2026-11-06
CVE-2026-109081 Keycloak-services: keycloak-services: injection of roles into realm default-roles via dcr endpoint CWE-862 6.8 Medium 2026-11-06
CVE-2026-107124 Keycloak-services: keycloak-services: oidc logout endpoint session fixation via id_token_hint leading to account takeover CWE-384 6.4 Medium 2026-11-06
CVE-2026-97175 Keycloak-services: keycloak-services: unverified idp email auto-linking enables account takeover CWE-287 8.8 High 2026-11-05
CVE-2026-97174 Keycloak-services: keycloak-services: ciba sub parameter injection causes attacker authentication to issue victim tokens CWE-20 6.8 Medium 2026-11-05
CVE-2026-112208 Keycloak-services: keycloak-services: account takeover via stale sso_auth note in organization identity-first login CWE-305 8.1 High 2026-11-05
CVE-2026-110932 Keycloak-services: keycloak-services: unauthenticated persistent disk exhaustion via theme gzip cache CWE-400 7.5 High 2026-11-05
CVE-2026-107123 Keycloak-services: keycloak-services: unauthenticated cpu denial of service via saml xml datetime and duration parsing CWE-400 7.5 High 2026-11-05
CVE-2026-107889 Keycloak-services: keycloak-services: stored xss on login page via kcsanitize bypass CWE-79 5.5 Medium 2026-10-09
CVE-2026-107623 Keycloak-services: keycloak-services: oidc dcr read-modify-write silently disables offline token revocation CWE-862 4.3 Medium 2026-10-08
CVE-2026-107121 Keycloak-services: keycloak-services: smtp starttls plaintext credential and message downgrade CWE-319 6.5 Medium 2026-10-07
CVE-2026-105305 Keycloak-services: keycloak-services: device authorization grant bypasses per-client minimum.acr.value enforcement CWE-287 5.4 Medium 2026-10-06
CVE-2026-103884 Keycloak-services: keycloak-services: path traversal in x.509 crl distribution point allows arbitrary local file read CWE-22 6.5 Medium 2026-10-01
CVE-2026-101333 Keycloak-services: keycloak-services: unbounded metric series creation via idp tag on broker login endpoint CWE-770 3.7 Low 2026-09-28
CVE-2026-96448 Keycloak-services: keycloak-services: fgap v2 composite-blind role mapping allows privilege escalation CWE-285 6.6 Medium 2026-09-25
CVE-2026-97846 Keycloak-services: keycloak-services: standard token exchange v2 bypasses mtls holder-of-key binding CWE-287 6.8 Medium 2026-09-25
CVE-2026-97311 Keycloak-services: keycloak-services: admin rest api role-groups endpoint discloses groups without authorization CWE-862 4.3 Medium 2026-09-24
CVE-2026-97177 Keycloak-services: keycloak-services: generic user update bypasses denied reset-password permission CWE-862 6.6 Medium 2026-09-24
CVE-2026-96445 Keycloak-services: keycloak-services: conditional otp skip-header policy evaluated against untrusted proxy headers CWE-287 6.8 Medium 2026-09-23
CVE-2026-96446 Keycloak-services: keycloak-services: par single-use bypass via prompt=none silent authentication path CWE-862 4.2 Medium 2026-09-23
CVE-2026-95503 Keycloak-services: keycloak-services: potential kdc spoofing bypass when kerberos password authentication is enabled CWE-347 6.8 Medium 2026-09-22
CVE-2026-94217 Keycloak-services: keycloak-services: uma scope merge across resource owners via resource name collision CWE-862 3.5 Low 2026-09-21
CVE-2026-94215 Keycloak-services: keycloak-services: cross-realm client read/write via request-level cache missing realm ownership check CWE-862 5.5 Medium 2026-09-21
CVE-2026-94213 Keycloak-services: keycloak-services: authorization services policy evaluation endpoint leaks user identity CWE-862 4.9 Medium 2026-09-21
CVE-2026-94001 Keycloak-services: keycloak-services: admin credential delete bypasses denied reset-password permission CWE-862 6.5 Medium 2026-09-19
CVE-2026-94000 Keycloak-services: keycloak-services: delegated admin with manage-users can escalate to realm-admin via group membership CWE-862 6.6 Medium 2026-09-19
CVE-2026-93999 Keycloak-services: keycloak-services: token refresh continues issuing tokens for disabled audience clients CWE-862 4.2 Medium 2026-09-19

All 41 known CVE vulnerabilities affecting Red Hat build of Keycloak 26.6.8 with full Chinese analysis, references, and POCs where available.