Red Hat build of Keycloak 26.4.9 vulnerabilities

2 known vulnerabilities in Red Hat build of Keycloak 26.4.9 from Red Hat. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.1 High severity

  Red Hat build of Keycloak 26.2: Improper Verification of Cryptographic Signature

  CVE-2026-1529Feb 9, 2026Red Hat

  A flaw was found in Keycloak. An attacker can exploit this vulnerability by modifying the organization ID and target email within a legitimate invitation token's JSON Web Token (JWT) payload. This lack of cryptographic signature verification allows the attacke

• 8.8 High severity

  Red Hat build of Keycloak 26.4: Improperly Implemented Security Check for Standard

  CVE-2026-1486Feb 9, 2026Red Hat

  A flaw was found in Keycloak. A vulnerability exists in the jwt-authorization-grant flow where the server fails to verify if an Identity Provider (IdP) is enabled before issuing tokens. The issuer lookup mechanism (lookupIdentityProviderFromIssuer) retrieves t