Red Hat Build Of Keycloak 26.2.11 vulnerabilities

4 CVEs affecting Red Hat Build Of Keycloak 26.2.11, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-13467, published 2025-11-25.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2025-13467, published 2025-11-25. Medium severity, CVSS 5.5. EPSS: 0.4% chance of exploitation in the next 30 days. A flaw was found in the Keycloak LDAP User Federation provider. This vulnerability allows an authenticated realm administrator to trigger deserialization of untrusted Java objects via a malicious…
CVE-2025-12110, published 2025-10-23. Medium severity, CVSS 5.4. EPSS: 0.3% chance of exploitation in the next 30 days. A flaw was found in Keycloak. An offline session continues to be valid when the offline_access scope is removed from the client. The refresh token is accepted and you can continue to request new…
CVE-2025-11429, published 2025-10-23. Medium severity, CVSS 5.4. EPSS: 0.2% chance of exploitation in the next 30 days. A flaw was found in Keycloak. Keycloak does not immediately enforce the disabling of the "Remember Me" realm setting on existing user sessions. Sessions created while "Remember Me" was active retain…
CVE-2025-12390, published 2025-10-28. Medium severity, CVSS 6.0. EPSS: 0.1% chance of exploitation in the next 30 days. A flaw was found in Keycloak. In Keycloak where a user can accidentally get access to another user's session if both use the same device and browser. This happens because Keycloak sometimes reuses…