Red Hat Build Of Keycloak 26.4.11 vulnerabilities

5 CVEs affecting Red Hat Build Of Keycloak 26.4.11, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-14083, published 2026-01-21.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-1180, published 2026-01-20. Medium severity, CVSS 5.8. EPSS: 0.4% chance of exploitation in the next 30 days. A flaw was identified in Keycloak’s OpenID Connect Dynamic Client Registration feature when clients authenticate using private_key_jwt. The issue allows a client to specify an arbitrary jwks_uri,…
CVE-2025-14083, published 2026-01-21. Low severity, CVSS 2.7. EPSS: 0.4% chance of exploitation in the next 30 days. A flaw was found in the Keycloak Admin REST API. This vulnerability allows the exposure of backend schema and rules, potentially leading to targeted attacks or privilege escalation via improper…
CVE-2025-14082, published 2025-12-10. Low severity, CVSS 2.7. EPSS: 0.4% chance of exploitation in the next 30 days. A flaw was found in Keycloak Admin REST (Representational State Transfer) API. This vulnerability allows information disclosure of sensitive role metadata via insufficient authorization checks on the…
CVE-2025-14777, published 2025-12-16. Medium severity, CVSS 6.0. EPSS: 0.3% chance of exploitation in the next 30 days. A flaw was found in Keycloak. An IDOR (Broken Access Control) vulnerability exists in the admin API endpoints for authorization resource management, specifically in ResourceSetService and…
CVE-2026-1035, published 2026-01-21. Low severity, CVSS 3.1. EPSS: 0.3% chance of exploitation in the next 30 days. A flaw was found in the Keycloak server during refresh token processing, specifically in the TokenManager class responsible for enforcing refresh token reuse policies. When strict refresh token…