Red Hat build of Keycloak 26.6.3 vulnerabilities

2 known vulnerabilities in Red Hat build of Keycloak 26.6.3 from Red Hat. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.8 High severity

  Red Hat build of Keycloak 26.4: Improper Validation of Specified Quantity in Input

  CVE-2026-9704May 27, 2026Red Hat

  A flaw was found in Keycloak. An authenticated user with low privileges can exploit this vulnerability by sending an oversized subject_token JSON Web Token (JWT) to the TokenEndpoint. When the token exceeds a 4000-character limit, it is silently dropped, causi

• 8.1 High severity

  Red Hat build of Keycloak 26.4: Authorization Bypass Through User-Controlled Key

  CVE-2026-9087May 20, 2026Red Hat

  A flaw was found in Keycloak. The cross-session verification proof is keyed only by (local userId, idpAlias) and is not bound to the upstream identity that was actually verified, so a second upstream account on the same IdP can consume it and get linked to the