RH
Product
Red Hat Build of Keycloak
116
CVEs
0
On KEV
9.8
Max CVSS
16
New 30D
Severity mix
Critical 4High 36Medium 66Low 10
Watch
Add Red Hat Build of Keycloak to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-2733 | 3.8 | Feb 19 | Org.keycloak/keycloak-services: keycloak: missing check on disabled client for docker registry protocol Affected: All versions, or not specified |
| CVE-2026-101333 | 3.7 | Sep 28 | Keycloak-services: keycloak-services: unbounded metric series creation via idp tag on broker login endpoint Affected: All versions, or not specified |
| CVE-2026-18569 | 3.7 | Aug 4 | Keycloak-services: keycloak-services: oidc backchannel logout accepts unsigned forged logout tokens Affected: All versions, or not specified |
| CVE-2026-18206 | 3.7 | Jul 31 | Keycloak-services: keycloak-services: client policy source-host wildcard domain matching bypass Affected: All versions, or not specified |
| CVE-2026-4633 | 3.7 | Mar 23 | Keycloak: keycloak: user enumeration via differential error messages Affected: All versions, or not specified |
| CVE-2026-0976 | 3.7 | Jan 15 | Org.keycloak/keycloak-quarkus-server: keycloak: proxy bypass due to improper handling of matrix parameters in url paths Affected: All versions, or not specified |
| CVE-2026-94217 | 3.5 | Sep 21 | Keycloak-services: keycloak-services: uma scope merge across resource owners via resource name collision Affected: All versions, or not specified |
| CVE-2026-94218 | 3.1 | Sep 21 | Keycloak-services: keycloak-services: 2fa setup enforcement bypass via authentication session restart endpoint Affected: All versions, or not specified |
| CVE-2026-4874 | 3.1 | Mar 26 | Org.keycloak.protocol.oidc.grants: org.keycloak.services.managers: keycloak: server-side request forgery via oidc token endpoint manipulation Affected: All versions, or not specified |
| CVE-2025-5416 | 2.7 | Jun 20 | Keycloak-core: keycloak environment information Affected: All versions, or not specified |
Showing 10
