Red Hat build of Keycloak 26.6.4 vulnerabilities
5 known vulnerabilities in Red Hat build of Keycloak 26.6.4 from Red Hat. 5 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 8.1 High severity
Red Hat build of Keycloak 26.6: Improper Verification of Cryptographic Signature
A flaw was found in Keycloak. This JWT algorithm confusion vulnerability in the JWT Authorization Grant flow allows an attacker with valid client credentials to bypass signature verification. By forging an assertion, the attacker can create unauthorized access
- 8.1 High severity
Red Hat build of Keycloak 26.4: Comparison Using Wrong Factors
A flaw was found in Keycloak Policy Enforcer. This vulnerability allows any authenticated user to bypass all authorization policies, including role, scope, and User-Managed Access (UMA) permission checks. By including the configured access-denied page path wit
- 7.7 High severity
Red Hat build of Keycloak 26.4: Authorization Bypass Through User-Controlled Key
A flaw was found in Keycloak. A missing authorization check in the GroupResource.addChild() endpoint within the Admin REST API allows an authenticated user with limited administrative privileges to reparent any existing group. When Fine-Grained Admin Permissio
- 7.3 High severity
Red Hat build of Keycloak 26.4: Improper Neutralization of Input During Web Page Generation
A flaw was found in Keycloak. A remote attacker with administrative privileges, specifically those with `manage-client` permission or access to client registration endpoints, could bypass client Uniform Resource Identifier (URI) validation. This is achieved by
- 7.3 High severity
Red Hat build of Keycloak 26.4: Incorrect Privilege Assignment
A flaw was found in Keycloak's Fine-Grained Admin Permissions (FGAPv2) feature. An administrator with limited client management permissions can exploit this vulnerability to assign any realm role, including highly privileged roles, to a client's scope mapping.