Red Hat build of Keycloak 26.2.15 vulnerabilities
4 known vulnerabilities in Red Hat build of Keycloak 26.2.15 from Red Hat. 4 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 8.1 High severity
Red Hat build of Keycloak 26.2: Incorrect Behavior Order: Authorization Before Parsing and Canonicalization
A flaw was found in Keycloak. An authenticated user with the uma_protection role can bypass User-Managed Access (UMA) policy validation. This allows the attacker to include resource identifiers owned by other users in a policy creation request, even if the URL
- 7.5 High severity
Red Hat build of Keycloak 26.2: Excessive Platform Resource Consumption within a Loop
A flaw was found in Keycloak. An unauthenticated attacker can exploit this vulnerability by sending a specially crafted POST request with an excessively long scope parameter to the OpenID Connect (OIDC) token endpoint. This leads to high resource consumption a
- 7.4 High severity
Red Hat build of Keycloak 26.2: Improper Isolation or Compartmentalization
A flaw was found in Keycloak. The SingleUseObjectProvider, a global key-value store, lacks proper type and namespace isolation. This vulnerability allows an unauthenticated attacker to forge authorization codes. Successful exploitation can lead to the creation
- 7.3 High severity
Red Hat build of Keycloak 26.2: URL Redirection to Untrusted Site
A flaw was found in Keycloak. This issue allows an attacker, who controls another path on the same web server, to bypass the allowed path in redirect Uniform Resource Identifiers (URIs) that use a wildcard. A successful attack may lead to the theft of an acces