Red Hat Build Of Keycloak 26.4.9 vulnerabilities

5 CVEs affecting Red Hat Build Of Keycloak 26.4.9, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-1529, published 2026-02-09.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-1486, published 2026-02-09. High severity, CVSS 8.8. EPSS: 0.5% chance of exploitation in the next 30 days. A flaw was found in Keycloak. A vulnerability exists in the jwt-authorization-grant flow where the server fails to verify if an Identity Provider (IdP) is enabled before issuing tokens. The issuer…
CVE-2026-1529, published 2026-02-09. High severity, CVSS 8.1. EPSS: 0.5% chance of exploitation in the next 30 days. A flaw was found in Keycloak. An attacker can exploit this vulnerability by modifying the organization ID and target email within a legitimate invitation token's JSON Web Token (JWT) payload. This…
CVE-2025-14559, published 2026-01-21. Medium severity, CVSS 6.5. EPSS: 0.5% chance of exploitation in the next 30 days. A flaw was found in the keycloak-services component of Keycloak. This vulnerability allows the issuance of access and refresh tokens for disabled users, leading to unauthorized use of previously…
CVE-2025-13881, published 2026-02-02. Low severity, CVSS 2.7. EPSS: 0.4% chance of exploitation in the next 30 days. A flaw was found in Keycloak Admin API. This vulnerability allows an administrator with limited privileges to retrieve sensitive custom attributes via the /unmanagedAttributes endpoint, bypassing…
CVE-2025-14778, published 2026-02-09. Medium severity, CVSS 5.4. EPSS: 0.3% chance of exploitation in the next 30 days. A flaw was found in Keycloak. A significant Broken Access Control vulnerability exists in the UserManagedPermissionService (UMA Protection API). When updating or deleting a UMA policy associated with…