Red Hat Build Of Keycloak 26.4.4 vulnerabilities

4 CVEs affecting Red Hat Build Of Keycloak 26.4.4, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-11538, published 2025-11-13.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2025-11538, published 2025-11-13. Medium severity, CVSS 6.8. EPSS: 0.4% chance of exploitation in the next 30 days. A vulnerability exists in Keycloak's server distribution where enabling debug mode (--debug <port>) insecurely defaults to binding the Java Debug Wire Protocol (JDWP) port to all network interfaces…
CVE-2025-10939, published 2025-10-28. Low severity, CVSS 3.7. EPSS: 0.4% chance of exploitation in the next 30 days. A flaw was found in Keycloak. The Keycloak guides recommend to not expose /admin path to the outside in case the installation is using a proxy. The issue occurs at least via ha-proxy, as it can be…
CVE-2025-12110, published 2025-10-23. Medium severity, CVSS 5.4. EPSS: 0.3% chance of exploitation in the next 30 days. A flaw was found in Keycloak. An offline session continues to be valid when the offline_access scope is removed from the client. The refresh token is accepted and you can continue to request new…
CVE-2025-12390, published 2025-10-28. Medium severity, CVSS 6.0. EPSS: 0.1% chance of exploitation in the next 30 days. A flaw was found in Keycloak. In Keycloak where a user can accidentally get access to another user's session if both use the same device and browser. This happens because Keycloak sometimes reuses…