Red Hat Build Of Keycloak 26.2 vulnerabilities

10 CVEs affecting Red Hat Build Of Keycloak 26.2, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-1529, published 2026-02-09.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2025-11419, published 2025-12-23. High severity, CVSS 7.5. EPSS: 0.7% chance of exploitation in the next 30 days. A flaw was found in Keycloak. This vulnerability allows an unauthenticated remote attacker to cause a denial of service (DoS) by repeatedly initiating TLS 1.2 client-initiated renegotiation requests…
CVE-2025-9162, published 2025-08-21. Medium severity, CVSS 4.9. EPSS: 0.5% chance of exploitation in the next 30 days. A flaw was found in org.keycloak/keycloak-model-storage-service. The KeycloakRealmImport custom resource substitutes placeholders within imported realm documents, potentially referencing environment…
CVE-2026-1529, published 2026-02-09. High severity, CVSS 8.1. EPSS: 0.5% chance of exploitation in the next 30 days. A flaw was found in Keycloak. An attacker can exploit this vulnerability by modifying the organization ID and target email within a legitimate invitation token's JSON Web Token (JWT) payload. This…
CVE-2025-3501, published 2025-04-29. High severity, CVSS 8.2. EPSS: 0.5% chance of exploitation in the next 30 days. A flaw was found in Keycloak. By setting a verification policy to 'ALL', the trust store certificate verification is skipped, which is unintended.
CVE-2025-13467, published 2025-11-25. Medium severity, CVSS 5.5. EPSS: 0.4% chance of exploitation in the next 30 days. A flaw was found in the Keycloak LDAP User Federation provider. This vulnerability allows an authenticated realm administrator to trigger deserialization of untrusted Java objects via a malicious…
CVE-2025-14778, published 2026-02-09. Medium severity, CVSS 5.4. EPSS: 0.3% chance of exploitation in the next 30 days. A flaw was found in Keycloak. A significant Broken Access Control vulnerability exists in the UserManagedPermissionService (UMA Protection API). When updating or deleting a UMA policy associated with…
CVE-2025-10044, published 2025-09-05. Medium severity, CVSS 4.3. EPSS: 0.3% chance of exploitation in the next 30 days. A flaw was found in Keycloak. Keycloak’s account console and other pages accept arbitrary text in the error_description query parameter. This text is directly rendered in error pages without…
CVE-2025-12110, published 2025-10-23. Medium severity, CVSS 5.4. EPSS: 0.3% chance of exploitation in the next 30 days. A flaw was found in Keycloak. An offline session continues to be valid when the offline_access scope is removed from the client. The refresh token is accepted and you can continue to request new…
CVE-2025-11429, published 2025-10-23. Medium severity, CVSS 5.4. EPSS: 0.2% chance of exploitation in the next 30 days. A flaw was found in Keycloak. Keycloak does not immediately enforce the disabling of the "Remember Me" realm setting on existing user sessions. Sessions created while "Remember Me" was active retain…
CVE-2025-12390, published 2025-10-28. Medium severity, CVSS 6.0. EPSS: 0.1% chance of exploitation in the next 30 days. A flaw was found in Keycloak. In Keycloak where a user can accidentally get access to another user's session if both use the same device and browser. This happens because Keycloak sometimes reuses…