Red Hat Build Of Keycloak 26.4 vulnerabilities

26 CVEs affecting Red Hat Build Of Keycloak 26.4, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-19607, published 2026-09-16.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-18963, published 2026-08-18. Critical severity, CVSS 9.1. EPSS: 3.2% chance of exploitation in the next 30 days. A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak. The issue allows an…
CVE-2026-74909, published 2026-09-16. High severity, CVSS 8.1. EPSS: 0.8% chance of exploitation in the next 30 days. Keycloak provides a policy enforcer to protect applications by matching incoming web requests against defined security policies. A flaw was found where the enforcer fails to correctly normalize web…
CVE-2026-79651, published 2026-09-16. High severity, CVSS 7.5. EPSS: 0.8% chance of exploitation in the next 30 days. A flaw was found in the theme localization endpoints of the keycloak-services component, which is the core service responsible for authentication flows and theme management in Keycloak. The issue…
CVE-2026-18212, published 2026-09-16. High severity, CVSS 7.5. EPSS: 0.5% chance of exploitation in the next 30 days. A flaw was found in the SAML Redirect Binding implementation of Keycloak, an open-source identity and access management solution. The issue occurs because the custom DEFLATE compression and…
CVE-2026-19607, published 2026-09-16. Medium severity, CVSS 5.3. EPSS: 0.5% chance of exploitation in the next 30 days. A flaw was found in the first-broker-login flow of the keycloak-services component. This component handles the initial authentication and account linking when a user logs in via an external identity…
CVE-2026-1486, published 2026-02-09. High severity, CVSS 8.8. EPSS: 0.5% chance of exploitation in the next 30 days. A flaw was found in Keycloak. A vulnerability exists in the jwt-authorization-grant flow where the server fails to verify if an Identity Provider (IdP) is enabled before issuing tokens. The issuer…
CVE-2026-1529, published 2026-02-09. High severity, CVSS 8.1. EPSS: 0.5% chance of exploitation in the next 30 days. A flaw was found in Keycloak. An attacker can exploit this vulnerability by modifying the organization ID and target email within a legitimate invitation token's JSON Web Token (JWT) payload. This…
CVE-2025-14559, published 2026-01-21. Medium severity, CVSS 6.5. EPSS: 0.5% chance of exploitation in the next 30 days. A flaw was found in the keycloak-services component of Keycloak. This vulnerability allows the issuance of access and refresh tokens for disabled users, leading to unauthorized use of previously…
CVE-2026-19729, published 2026-09-09. Medium severity, CVSS 4.9. EPSS: 0.5% chance of exploitation in the next 30 days. A flaw was found in the key provider component of the keycloak-services library, which is the core engine for the Red Hat Build of Keycloak. The issue occurs because a previous fix for path probing…
CVE-2026-2733, published 2026-02-19. Low severity, CVSS 3.8. EPSS: 0.5% chance of exploitation in the next 30 days. A flaw was identified in the Docker v2 authentication endpoint of Keycloak, where tokens continue to be issued even after a Docker registry client has been administratively disabled. This means that…

Latest

CVE-2026-17526, published 2026-09-16. High severity, CVSS 7.2. EPSS: 0.5% chance of exploitation in the next 30 days. Keycloak is an open-source identity and access management solution. A vulnerability was discovered where a user with the impersonation role can impersonate a realm administrator. This allows the…
CVE-2026-9088, published 2026-06-05. Low severity, CVSS 2.7. EPSS: 0.5% chance of exploitation in the next 30 days. A flaw was found in org.keycloak.services. An administrator with delegated access to read group memberships and users can bypass user profile permissions by accessing the group members endpoint. This…