RH
Product
Red Hat Build of Keycloak
by Red Hat · last CVE Oct 30, 2026
116
CVEs
0
On KEV
9.8
Max CVSS
16
New 30D
Severity mix
Critical 4High 36Medium 66Low 10
Watch

Add Red Hat Build of Keycloak to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-2733
3.8
0%
Feb 19
Org.keycloak/keycloak-services: keycloak: missing check on disabled client for docker registry protocol
Affected: All versions, or not specified
CVE-2026-101333
3.7
0%
Sep 28
Keycloak-services: keycloak-services: unbounded metric series creation via idp tag on broker login endpoint
Affected: All versions, or not specified
CVE-2026-18569
3.7
0%
Aug 4
Keycloak-services: keycloak-services: oidc backchannel logout accepts unsigned forged logout tokens
Affected: All versions, or not specified
CVE-2026-18206
3.7
0%
Jul 31
Keycloak-services: keycloak-services: client policy source-host wildcard domain matching bypass
Affected: All versions, or not specified
CVE-2026-4633
3.7
0%
Mar 23
Keycloak: keycloak: user enumeration via differential error messages
Affected: All versions, or not specified
CVE-2026-0976
3.7
0%
Jan 15
Org.keycloak/keycloak-quarkus-server: keycloak: proxy bypass due to improper handling of matrix parameters in url paths
Affected: All versions, or not specified
CVE-2026-94217
3.5
0%
Sep 21
Keycloak-services: keycloak-services: uma scope merge across resource owners via resource name collision
Affected: All versions, or not specified
CVE-2026-94218
3.1
0%
Sep 21
Keycloak-services: keycloak-services: 2fa setup enforcement bypass via authentication session restart endpoint
Affected: All versions, or not specified
CVE-2026-4874
3.1
0%
Mar 26
Org.keycloak.protocol.oidc.grants: org.keycloak.services.managers: keycloak: server-side request forgery via oidc token endpoint manipulation
Affected: All versions, or not specified
CVE-2025-5416
2.7
0%
Jun 20
Keycloak-core: keycloak environment information
Affected: All versions, or not specified
Showing 10