Red Hat build of Keycloak 26.0 vulnerabilities | LiveThreat CVE Feed

Product

Red Hat build of Keycloak 26.0

by Red Hat · last CVE Dec 23, 2025

CVEs

On KEV

8.2

Max CVSS

New 30D

Vulnerabilities16 In the news0 Timeline

Severity mix

Critical 0High 3Medium 12Low 1

Severity

All severities16 Critical0 High3 Medium12 Low1

Exploitation

On CISA KEV0 Exploited in the wild0

Watch

Add Red Hat build of Keycloak 26.0 to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2024-11734	6.5	1%	Jan 14	Org.keycloak:keycloak-quarkus-server: denial of service in keycloak server via security headers Affected: All versions, or not specified
CVE-2024-10270	6.5	1%	Nov 25	Org.keycloak:keycloak-services: keycloak denial of service Affected: All versions, or not specified
CVE-2024-10451	5.9	1%	Nov 25	Org.keycloak:keycloak-quarkus-server: sensitive data exposure in keycloak build process Affected: All versions, or not specified
CVE-2025-3910	5.4	0%	Apr 29	Org.keycloak.authentication: two factor authentication bypass Affected: All versions, or not specified
CVE-2025-1391	5.4	0%	Feb 17	Keycloak-services: improper authorization in keycloak organization mapper allows unauthorized organization claims Affected: All versions, or not specified
CVE-2025-0604	5.4	1%	Jan 22	Keycloak-ldap-federation: authentication bypass due to missing ldap bind after password reset in keycloak Affected: All versions, or not specified
CVE-2025-8419	5.3	1%	Aug 6	Org.keycloak/keycloak-services: keycloak smtp inject vulnerability Affected: All versions, or not specified
CVE-2025-9162	4.9	1%	Aug 21	Org.keycloak/keycloak-model-storage-service: variable injection into environment variables Affected: All versions, or not specified
CVE-2025-2559	4.9	1%	Mar 25	Org.keycloak/keycloak-services: jwt token cache exhaustion leading to denial of service (dos) in keycloak Affected: All versions, or not specified
CVE-2024-11736	4.9	1%	Jan 14	Org.keycloak:keycloak-quarkus-server: unrestricted admin use of system and environment variables Affected: All versions, or not specified
CVE-2024-9666	4.7	0%	Nov 25	Org.keycloak/keycloak-quarkus-server: keycloak proxy header handling denial-of-service (dos) vulnerability Affected: All versions, or not specified
CVE-2025-10044	4.3	0%	Sep 5	Keycloak: keycloak error_description injection on error pages Affected: All versions, or not specified