Red Hat Build Of Keycloak 26.2.13 vulnerabilities

2 CVEs affecting Red Hat Build Of Keycloak 26.2.13, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-1529, published 2026-02-09.

More from Red Hat.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2026-1529, published 2026-02-09. High severity, CVSS 8.1. EPSS: 0.5% chance of exploitation in the next 30 days. A flaw was found in Keycloak. An attacker can exploit this vulnerability by modifying the organization ID and target email within a legitimate invitation token's JSON Web Token (JWT) payload. This…
• CVE-2025-14778, published 2026-02-09. Medium severity, CVSS 5.4. EPSS: 0.3% chance of exploitation in the next 30 days. A flaw was found in Keycloak. A significant Broken Access Control vulnerability exists in the UserManagedPermissionService (UMA Protection API). When updating or deleting a UMA policy associated with…