Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Red Hat build of Keycloak 26.6.8 — Vulnerabilities & Security Advisories 41

All 41 CVE vulnerabilities found in Red Hat build of Keycloak 26.6.8, with AI-generated Chinese analysis, references, and POCs.

This page aggregates confirmed security weaknesses specifically affecting the Red Hat build of Keycloak 26.6.8, an identity and access management server. The collection encompasses a broad spectrum of reported flaws, ranging from authentication bypasses and cryptographic errors to input validation issues, covering the entire release lifecycle from the initial version launch through all subsequent security updates for this specific minor release line. Visitors can utilize this resource to track official vendor advisories, analyze the prevalence and impact of specific weakness classes within the Keycloak ecosystem, or review the complete historical vulnerability record for this product version. The data presented is derived directly from public security bulletins and verified vulnerability databases, ensuring accuracy without speculative entries. By centralizing these critical security details, the page enables security professionals to assess risk exposure, prioritize patching efforts, and maintain compliance with organizational security standards. This comprehensive view supports effective vulnerability management by providing a single, authoritative source for understanding the security posture of Red Hat build of Keycloak 26.6.8 across its deployment history. Users seeking detailed technical analysis or remediation guidance will find relevant context for each listed issue, facilitating informed decision-making regarding system hardening and upgrade strategies.

Vendor: Red Hat

CVE ID Title CVSS Severity Published
CVE-2026-92358 Keycloak-services: keycloak-services: residual cross-browser account-link proof allows silent re-linking CWE-613 6.4 Medium 2026-09-16
CVE-2026-89298 Keycloak-services: keycloak-services: confidential client secret disclosed to view-clients role via client registration get CWE-200 4.9 Medium 2026-09-11
CVE-2026-88770 Keycloak-services: keycloak-services: device authorization grant issues tokens to brute-force-locked accounts CWE-307 6.5 Medium 2026-09-10
CVE-2026-82968 Keycloak-services: keycloak-services: cross-session email verification proof not bound to upstream identity for social providers CWE-639 6.4 Medium 2026-09-02
CVE-2026-19608 Keycloak-services: keycloak-services: name-only group claims let same-name groups satisfy path-specific group policies CWE-285 5.3 Medium 2026-08-18
CVE-2026-18203 Keycloak-services: keycloak-services: group policy extendchildren matches sibling group path prefixes CWE-863 6.5 Medium 2026-07-31
CVE-2026-18208 Keycloak-services: keycloak-services: inactive out-of-audience token introspection leaks signed jwt claim CWE-862 6.5 Medium 2026-07-31
CVE-2026-18207 Keycloak-services: keycloak-services: client policy source-group condition bypass via duplicate group name matching CWE-285 6.5 Medium 2026-07-29
CVE-2026-16103 Keycloak-services: keycloak-services: incomplete fix for ciba brute-force lockout bypass at token redemption CWE-305 4.3 Medium 2026-07-17
CVE-2026-15943 Keycloak-services: keycloak-services: oidc idp update reuses masked client secret after token url change CWE-1288 5.5 Medium 2026-07-17
CVE-2026-12388 Keycloak-broker: keycloak: privilege escalation to realm administrator via improper authorization in identity provider mapper CWE-266 6.5 Medium 2026-06-30

All 41 known CVE vulnerabilities affecting Red Hat build of Keycloak 26.6.8 with full Chinese analysis, references, and POCs where available.