Red Hat Single Sign-On vulnerabilities

111 CVEs affecting Red Hat Single Sign-On, 1 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-16102, published 2026-08-05.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2023-44487: HTTP/2 Rapid Reset Attack Vulnerability, published 2023-10-10. High severity, CVSS 7.5. Actively exploited: in CISA KEV since 2023-10-10. EPSS: 100% chance of exploitation in the next 30 days. The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.
CVE-2023-48795, published 2023-12-18. Medium severity, CVSS 5.9. EPSS: 93.5% chance of exploitation in the next 30 days. The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packets are omitted (from…
CVE-2019-9515, published 2019-08-13. High severity, CVSS 7.5. EPSS: 87.4% chance of exploitation in the next 30 days. Some HTTP/2 implementations are vulnerable to a settings flood, potentially leading to a denial of service. The attacker sends a stream of SETTINGS frames to the peer. Since the RFC requires that the…
CVE-2019-9514, published 2019-08-13. High severity, CVSS 7.5. EPSS: 82.8% chance of exploitation in the next 30 days. Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service. The attacker opens a number of streams and sends an invalid request over each stream that…
CVE-2021-4104, published 2021-12-14. High severity, CVSS 7.5. EPSS: 80.6% chance of exploitation in the next 30 days. JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration. The attacker can provide TopicBindingName and…
CVE-2020-27838, published 2021-03-08. Medium severity, CVSS 6.5. EPSS: 17.9% chance of exploitation in the next 30 days. A flaw was found in keycloak in versions prior to 13.0.0. The client registration endpoint allows fetching information about PUBLIC clients (like client secret) without authentication which could be…
CVE-2018-12023, published 2019-03-21. High severity, CVSS 7.5. EPSS: 8.9% chance of exploitation in the next 30 days. An issue was discovered in FasterXML jackson-databind prior to 2.7.9.4, 2.8.11.2, and 2.9.6. When Default Typing is enabled (either globally or for a specific property), the service has the Oracle…
CVE-2019-14379, published 2019-07-29. Critical severity, CVSS 9.8. EPSS: 8.1% chance of exploitation in the next 30 days. SubTypeValidator.java in FasterXML jackson-databind before 2.9.9.2 mishandles default typing when ehcache is used (because of net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup),…
CVE-2018-12022, published 2019-03-21. High severity, CVSS 7.5. EPSS: 7.3% chance of exploitation in the next 30 days. An issue was discovered in FasterXML jackson-databind prior to 2.7.9.4, 2.8.11.2, and 2.9.6. When Default Typing is enabled (either globally or for a specific property), the service has the Jodd-db…
CVE-2024-1635, published 2024-02-19. High severity, CVSS 7.5. EPSS: 4.6% chance of exploitation in the next 30 days. A vulnerability was found in Undertow. This vulnerability impacts a server that supports the wildfly-http-client protocol. Whenever a malicious user opens and closes a connection with the HTTP port…

Latest

CVE-2026-16102, published 2026-08-05. High severity, CVSS 8.1. EPSS: 0.5% chance of exploitation in the next 30 days. A flaw was found in the Dynamic Client Registration (DCR) component of Keycloak, an identity and access management solution. The default DCR policy fails to properly validate the claim path for User…
CVE-2026-15573, published 2026-08-05. High severity, CVSS 8.1. EPSS: 0.5% chance of exploitation in the next 30 days. A flaw was found in Keycloak's Authorization Services. The component responsible for matching request paths to security policies (PathMatcher) does not properly normalize URIs before comparison. By…
CVE-2026-16093, published 2026-07-17. Medium severity, CVSS 5.4. EPSS: 0.4% chance of exploitation in the next 30 days. Keycloak provides a mechanism called Client Policies to enforce security requirements on clients, such as requiring them to use signed JWTs for authentication. A flaw was discovered where this…
CVE-2026-15945, published 2026-07-16. Low severity, CVSS 2.7. EPSS: 0.3% chance of exploitation in the next 30 days. A flaw was found in the group search functionality of the Keycloak server's administrative API. When Fine-Grained Admin Permissions (FGAP) v2 is enabled, a delegated administrator can bypass access…
CVE-2026-28369, published 2026-03-27. Critical severity, CVSS 9.1. EPSS: 0.9% chance of exploitation in the next 30 days. A flaw was found in Undertow. When Undertow receives an HTTP request where the first header line starts with one or more spaces, it incorrectly processes the request by stripping these leading…
CVE-2026-28368, published 2026-03-27. Critical severity, CVSS 9.1. EPSS: 0.9% chance of exploitation in the next 30 days. A flaw was found in Undertow. This vulnerability allows a remote attacker to construct specially crafted requests where header names are parsed differently by Undertow compared to upstream proxies.…
CVE-2026-28367, published 2026-03-27. Critical severity, CVSS 9.1. EPSS: 0.9% chance of exploitation in the next 30 days. A flaw was found in Undertow. A remote attacker can exploit this vulnerability by sending `\r\r\r` as a header block terminator. This can be used for request smuggling with certain proxy servers,…
CVE-2026-3121, published 2026-03-26. High severity, CVSS 7.2. EPSS: 0.5% chance of exploitation in the next 30 days. A flaw was found in Keycloak. An administrator with `manage-clients` permission can exploit a misconfiguration where this permission is equivalent to `manage-permissions`. This allows the…
CVE-2026-4874, published 2026-03-26. Low severity, CVSS 3.1. EPSS: 0.3% chance of exploitation in the next 30 days. A flaw was found in Keycloak. An authenticated attacker can perform Server-Side Request Forgery (SSRF) by manipulating the `client_session_host` parameter during refresh token requests. This occurs…
CVE-2026-4366, published 2026-03-18. Medium severity, CVSS 5.8. EPSS: 0.4% chance of exploitation in the next 30 days. A flaw was identified in Keycloak, an identity and access management solution, where it improperly follows HTTP redirects when processing certain client configuration requests. This behavior allows…