Red Hat Build Of Keycloak 26.0 vulnerabilities

13 CVEs affecting Red Hat Build Of Keycloak 26.0, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-11419, published 2025-12-23.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2024-10270, published 2024-11-25. Medium severity, CVSS 6.5. EPSS: 1.2% chance of exploitation in the next 30 days. A vulnerability was found in the Keycloak-services package. If untrusted data is passed to the SearchQueryUtils method, it could lead to a denial of service (DoS) scenario by exhausting system…
CVE-2024-11734, published 2025-01-14. Medium severity, CVSS 6.5. EPSS: 1% chance of exploitation in the next 30 days. A denial of service vulnerability was found in Keycloak that could allow an administrative user with the right to change realm settings to disrupt the service. This action is done by modifying any of…
CVE-2024-10451, published 2024-11-25. Medium severity, CVSS 5.9. EPSS: 0.9% chance of exploitation in the next 30 days. A flaw was found in Keycloak. This issue occurs because sensitive runtime values, such as passwords, may be captured during the Keycloak build process and embedded as default values in bytecode,…
CVE-2024-11736, published 2025-01-14. Medium severity, CVSS 4.9. EPSS: 0.8% chance of exploitation in the next 30 days. A vulnerability was found in Keycloak. Admin users may have to access sensitive server environment variables and system properties through user-configurable URLs. When configuring backchannel logout…
CVE-2025-11419, published 2025-12-23. High severity, CVSS 7.5. EPSS: 0.7% chance of exploitation in the next 30 days. A flaw was found in Keycloak. This vulnerability allows an unauthenticated remote attacker to cause a denial of service (DoS) by repeatedly initiating TLS 1.2 client-initiated renegotiation requests…
CVE-2024-10492, published 2024-11-25. Low severity, CVSS 2.7. EPSS: 0.7% chance of exploitation in the next 30 days. A vulnerability was found in Keycloak. A user with high privileges could read sensitive information from a Vault file that is not within the expected context. This attacker must have previous high…
CVE-2025-2559, published 2025-03-25. Medium severity, CVSS 4.9. EPSS: 0.7% chance of exploitation in the next 30 days. A flaw was found in Keycloak. When the configuration uses JWT tokens for authentication, the tokens are cached until expiration. If a client uses JWT tokens with an excessively long expiration time,…
CVE-2025-0604, published 2025-01-22. Medium severity, CVSS 5.4. EPSS: 0.6% chance of exploitation in the next 30 days. A flaw was found in Keycloak. When an Active Directory user resets their password, the system updates it without performing an LDAP bind to validate the new credentials against AD. This vulnerability…
CVE-2025-9162, published 2025-08-21. Medium severity, CVSS 4.9. EPSS: 0.5% chance of exploitation in the next 30 days. A flaw was found in org.keycloak/keycloak-model-storage-service. The KeycloakRealmImport custom resource substitutes placeholders within imported realm documents, potentially referencing environment…
CVE-2025-3501, published 2025-04-29. High severity, CVSS 8.2. EPSS: 0.5% chance of exploitation in the next 30 days. A flaw was found in Keycloak. By setting a verification policy to 'ALL', the trust store certificate verification is skipped, which is unintended.

Latest

CVE-2025-10044, published 2025-09-05. Medium severity, CVSS 4.3. EPSS: 0.3% chance of exploitation in the next 30 days. A flaw was found in Keycloak. Keycloak’s account console and other pages accept arbitrary text in the error_description query parameter. This text is directly rendered in error pages without…
CVE-2025-1391, published 2025-02-17. Medium severity, CVSS 5.4. EPSS: 0.4% chance of exploitation in the next 30 days. A flaw was found in the Keycloak organization feature, which allows the incorrect assignment of an organization to a user if their username or email matches the organization’s domain pattern. This…
CVE-2024-9666, published 2024-11-25. Medium severity, CVSS 4.7. EPSS: 0.4% chance of exploitation in the next 30 days. A vulnerability was found in the Keycloak Server. The Keycloak Server is vulnerable to a denial of service (DoS) attack due to improper handling of proxy headers. When Keycloak is configured to…