Red Hat build of Keycloak 26.0 vulnerabilities

2 known vulnerabilities in Red Hat build of Keycloak 26.0 from Red Hat. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.5 High severity

  Red Hat build of Keycloak 26.0: Allocation of Resources Without Limits or Throttling

  CVE-2025-11419Dec 23, 2025Red Hat

  A flaw was found in Keycloak. This vulnerability allows an unauthenticated remote attacker to cause a denial of service (DoS) by repeatedly initiating TLS 1.2 client-initiated renegotiation requests to exhaust server CPU resources, making the service unavailab

• 7.1 High severity

  Red Hat build of Keycloak 26: Origin Validation Error

  CVE-2025-7365Jul 10, 2025Red Hat

  A flaw was found in Keycloak. When an authenticated attacker attempts to merge accounts with another existing account during an identity provider (IdP) login, the attacker will subsequently be prompted to "review profile" information. This vulnerability allows