Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1325 CNY

100%

Red Hat Build of Keycloak — Vulnerabilities & Security Advisories 14

All 14 CVE vulnerabilities found in Red Hat Build of Keycloak, with AI-generated Chinese analysis, references, and POCs.

This page catalogs known Common Weakness Enumerations associated with the Red Hat Build of Keycloak vulnerability aggregation service. It aggregates security data from various sources to provide a comprehensive view of potential risks inherent in this specific identity and access management solution. The collection includes vulnerabilities spanning from the initial public release of the product through recent quarterly updates, ensuring that both legacy and current deployments are accounted for within the historical record. Users can track vendor-specific advisories issued by Red Hat to understand the remediation status of each flaw, gain deeper insight into the mechanics and impact of specific weakness classes affecting the application, and review the complete vulnerability history of the product to assess long-term security posture. This resource is designed for security analysts, system administrators, and compliance officers who need to evaluate the attack surface of their Keycloak deployments. By consolidating disparate security notices and technical details into a single accessible interface, the page facilitates more efficient risk assessment and patch management processes. It serves as a factual reference point for understanding how the Red Hat Build of Keycloak has been affected by various security flaws over time, allowing stakeholders to make informed decisions regarding upgrades, configuration changes, or compensating controls. The information presented here is strictly technical and aims to support operational security activities without promotional context.

Vendor: Red Hat

CVE IDTitleCVSSSeverityPublished
CVE-2026-11986 Keycloak-rest-admin-ui-ext: authorization bypass vulnerability in the admin-ui-ext bulk role-mapping-delete endpoints of keycloak CWE-425 4.9 Medium2026-06-11
CVE-2026-11577 Keycloak: keycloak: privilege escalation via partialimport fgap permission bypass CWE-863 7.2 High2026-06-08
CVE-2026-9798 Keycloak: keycloak: brute-force protection bypass in ciba flow CWE-305 4.3 Medium2026-05-28
CVE-2026-9796 Keycloak: keycloak: privilege escalation via time-of-check to time-of-use (toctou) vulnerability CWE-367 6.5 Medium2026-05-28
CVE-2026-9795 Keycloak: keycloak: privilege escalation via improper scope mapping enforcement CWE-266 7.3 High2026-05-28
CVE-2026-9793 Keycloak: keycloak: security policy bypass in jwe-encrypted request object processing CWE-347 5.9 Medium2026-05-28
CVE-2026-9689 Keycloak: org.keycloak.protocol.oidc: http parameter pollution in oidc redirect uri allows response parameter duplication - #ghi-604 CWE-1288 4.2 Medium2026-05-27
CVE-2026-37980 Org.keycloak.forms.login: keycloak: keycloak: arbitrary code execution via stored cross-site scripting (xss) in organization selection login page CWE-79 6.9 Medium2026-04-14
CVE-2026-4633 Keycloak: keycloak: user enumeration via differential error messages CWE-209 3.7 Low2026-03-23
CVE-2026-4628 Keycloak: org.keycloak.authorization: keycloak: unauthorized resource modification due to improper access control CWE-284 4.3 Medium2026-03-23
CVE-2025-11537 Keycloak-server: sensitive headers shown in the http access logs CWE-117 5.0 Medium2026-02-10
CVE-2026-1518 Keycloak: blind server-side request forgery (ssrf) via ciba backchannel notification endpoint in keycloak CWE-918 2.7 Low2026-02-02
CVE-2026-0976 Org.keycloak/keycloak-quarkus-server: keycloak: proxy bypass due to improper handling of matrix parameters in url paths CWE-20 3.7 Low2026-01-15
CVE-2025-5416 Keycloak-core: keycloak environment information CWE-497 2.7 Low2025-06-20

All 14 known CVE vulnerabilities affecting Red Hat Build of Keycloak with full Chinese analysis, references, and POCs where available.