RH
Product
Red Hat Build of Keycloak
95
CVEs
0
On KEV
9.8
Max CVSS
11
New 30D
Severity mix
Critical 3High 34Medium 50Low 8
Watch
Add Red Hat Build of Keycloak to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-101333 | 3.7 | Sep 28 | Keycloak-services: keycloak-services: unbounded metric series creation via idp tag on broker login endpoint Affected: All versions, or not specified |
| CVE-2026-18569 | 3.7 | Aug 4 | Keycloak-services: keycloak-services: oidc backchannel logout accepts unsigned forged logout tokens Affected: All versions, or not specified |
| CVE-2026-18206 | 3.7 | Jul 31 | Keycloak-services: keycloak-services: client policy source-host wildcard domain matching bypass Affected: All versions, or not specified |
| CVE-2026-4633 | 3.7 | Mar 23 | Keycloak: keycloak: user enumeration via differential error messages Affected: All versions, or not specified |
| CVE-2026-0976 | 3.7 | Jan 15 | Org.keycloak/keycloak-quarkus-server: keycloak: proxy bypass due to improper handling of matrix parameters in url paths Affected: All versions, or not specified |
| CVE-2026-94217 | 3.5 | Sep 21 | Keycloak-services: keycloak-services: uma scope merge across resource owners via resource name collision Affected: All versions, or not specified |
| CVE-2026-94218 | 3.1 | Sep 21 | Keycloak-services: keycloak-services: 2fa setup enforcement bypass via authentication session restart endpoint Affected: All versions, or not specified |
| CVE-2026-4874 | 3.1 | Mar 26 | Org.keycloak.protocol.oidc.grants: org.keycloak.services.managers: keycloak: server-side request forgery via oidc token endpoint manipulation Affected: All versions, or not specified |
Showing 8