Red Hat Build Of Keycloak vulnerabilities

111 CVEs affecting Red Hat Build Of Keycloak, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-18967, published 2026-08-06.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2024-7885, published 2024-08-21. High severity, CVSS 7.5. EPSS: 2.6% chance of exploitation in the next 30 days. A vulnerability was found in Undertow where the ProxyProtocolReadListener reuses the same StringBuilder instance across multiple requests. This issue occurs when the parseProxyProtocolV1 method…
CVE-2024-8883, published 2024-09-19. Medium severity, CVSS 6.1. EPSS: 2.1% chance of exploitation in the next 30 days. A misconfiguration flaw was found in Keycloak. This issue can allow an attacker to redirect users to an arbitrary URL if a 'Valid Redirect URI' is set to http://localhost or http://127.0.0.1,…
CVE-2024-1132, published 2024-04-17. High severity, CVSS 8.1. EPSS: 1.6% chance of exploitation in the next 30 days. A flaw was found in Keycloak, where it does not properly validate URLs included in a redirect. This issue could allow an attacker to construct a malicious request to bypass validation and access…
CVE-2026-7507, published 2026-05-19. High severity, CVSS 7.5. EPSS: 1.1% chance of exploitation in the next 30 days. A session fixation vulnerability was found in Keycloak's login-actions endpoints. An unauthenticated attacker could exploit this flaw by pre-creating an authentication session and tricking a victim…
CVE-2026-7307, published 2026-05-19. High severity, CVSS 7.5. EPSS: 1% chance of exploitation in the next 30 days. A flaw was found in Keycloak. A remote, unauthenticated attacker can send a specially crafted XML input to the Security Assertion Markup Language (SAML) endpoint. This malicious input can cause high…
CVE-2026-9801, published 2026-05-28. Medium severity, CVSS 4.9. EPSS: 0.9% chance of exploitation in the next 30 days. A flaw was found in Keycloak. A remote attacker with high privileges, such as a realm administrator configuring a malicious Lightweight Directory Access Protocol (LDAP) server or an attacker…
CVE-2026-3047, published 2026-03-05. High severity, CVSS 8.8. EPSS: 0.9% chance of exploitation in the next 30 days. A flaw was found in org.keycloak.broker.saml. When a disabled Security Assertion Markup Language (SAML) client is configured as an Identity Provider (IdP)-initiated broker landing target, it can…
CVE-2026-2575, published 2026-03-18. Medium severity, CVSS 5.3. EPSS: 0.9% chance of exploitation in the next 30 days. A flaw was found in Keycloak. An unauthenticated remote attacker can trigger an application level Denial of Service (DoS) by sending a highly compressed SAMLRequest through the SAML Redirect Binding.…
CVE-2026-4634, published 2026-04-02. High severity, CVSS 7.5. EPSS: 0.9% chance of exploitation in the next 30 days. A flaw was found in Keycloak. An unauthenticated attacker can exploit this vulnerability by sending a specially crafted POST request with an excessively long scope parameter to the OpenID Connect…
CVE-2024-7341, published 2024-09-09. High severity, CVSS 7.1. EPSS: 0.8% chance of exploitation in the next 30 days. A session fixation issue was discovered in the SAML adapters provided by Keycloak. The session ID and JSESSIONID cookie are not changed at login time, even when the turnOffChangeSessionIdOnLogin…

Latest

CVE-2026-18967, published 2026-08-06. High severity, CVSS 8.1. EPSS: 0.2% chance of exploitation in the next 30 days. A flaw was found in the SAML broker component of Keycloak, an identity and access management solution. When configured as a SAML broker using the IdP-Initiated flow, Keycloak fails to enforce the…
CVE-2026-16442, published 2026-08-05. Critical severity, CVSS 9.8. EPSS: 0.3% chance of exploitation in the next 30 days. A flaw was found in the SAML broker component of Keycloak, which is used to manage identity federation and user authentication. The issue occurs because the IdP-initiated Single Sign-On endpoint…
CVE-2026-15572, published 2026-08-05. High severity, CVSS 8.8. EPSS: 0.7% chance of exploitation in the next 30 days. A flaw was found in Keycloak's Dynamic Client Registration (DCR) security policy management. The "Allowed Protocol Mapper Types" policy, which restricts which types of data mappers a client can use,…
CVE-2026-16102, published 2026-08-05. High severity, CVSS 8.1. EPSS: 0.5% chance of exploitation in the next 30 days. A flaw was found in the Dynamic Client Registration (DCR) component of Keycloak, an identity and access management solution. The default DCR policy fails to properly validate the claim path for User…
CVE-2026-16100, published 2026-08-05. Medium severity, CVSS 6.5. EPSS: 0.6% chance of exploitation in the next 30 days. A flaw was found in the user-event metrics recording of Keycloak. When metrics are enabled, the system records raw error messages from failed account operations as Prometheus metric labels. Because…
CVE-2026-16071, published 2026-08-05. Medium severity, CVSS 5.4. EPSS: 0.3% chance of exploitation in the next 30 days. A flaw was found in the LDAP storage provider of Keycloak, which is used to federate user identities from external directories. The issue occurs when a delegated administrator performs a search using…
CVE-2026-15573, published 2026-08-05. High severity, CVSS 8.1. EPSS: 0.5% chance of exploitation in the next 30 days. A flaw was found in Keycloak's Authorization Services. The component responsible for matching request paths to security policies (PathMatcher) does not properly normalize URIs before comparison. By…
CVE-2026-16443, published 2026-08-05. Critical severity, CVSS 9.1. EPSS: 0.3% chance of exploitation in the next 30 days. A flaw was found in the SAML metadata import functionality of the keycloak-services component, which is the core engine for identity brokering in Red Hat Build of Keycloak. When importing identity…
CVE-2026-18569, published 2026-08-04. Low severity, CVSS 3.7. EPSS: 0.3% chance of exploitation in the next 30 days. A flaw was found in the backchannel logout endpoint of the keycloak-services component, which is part of the Red Hat Build of Keycloak. This component handles authentication and session management…
CVE-2026-18573, published 2026-08-02. Medium severity, CVSS 6.5. EPSS: 0.5% chance of exploitation in the next 30 days. A flaw was found in the keycloak-services component of Keycloak, which is used for managing authentication and authorization flows. The issue occurs when a realm administrator configures client…