Red Hat build of Keycloak 26.6.7 vulnerabilities
8 known vulnerabilities in Red Hat build of Keycloak 26.6.7 from Red Hat. 8 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 7.2 High severity
Red Hat build of Keycloak 26.4: Missing Authorization
Keycloak is an open-source identity and access management solution. A vulnerability was discovered where a user with the impersonation role can impersonate a realm administrator. This allows the attacker to gain full administrative control over the realm, incl
- 7.5 High severity
Red Hat build of Keycloak 26.4: Uncontrolled Resource Consumption
A flaw was found in the theme localization endpoints of the keycloak-services component, which is the core service responsible for authentication flows and theme management in Keycloak. The issue occurs because the system accepts arbitrary locale tags from una
- 8.1 High severity
Red Hat build of Keycloak 26.4: Missing Authorization
Keycloak provides a policy enforcer to protect applications by matching incoming web requests against defined security policies. A flaw was found where the enforcer fails to correctly normalize web addresses that contain special encoded characters, such as tho
- 7.5 High severity
Red Hat build of Keycloak 26.4: Missing Release of Memory after Effective Lifetime
A flaw was found in the SAML Redirect Binding implementation of Keycloak, an open-source identity and access management solution. The issue occurs because the custom DEFLATE compression and decompression helpers fail to release native zlib memory after use. An
- 7.5 High severity
Red Hat Build of Apache Camel 3.33.3.SP1: Improper Restriction of XML External Entity Reference
A flaw was found in RESTEasy's SourceProvider. This vulnerability allows an unauthenticated attacker to perform an unauthenticated remote file read. By sending a specially crafted XML body with a DOCTYPE declaration referencing external entities to an endpoint
- 7.2 High severity
Red Hat build of Keycloak 26.6: Missing Authorization
A flaw was found in the user creation component of Keycloak when Fine-Grained Admin Permissions V2 (FGAP V2) is enabled. This issue allows a sub-administrator with permission to create users to add those users to any group, even groups the sub-administrator is
- 8.1 High severity
Red Hat build of Keycloak 26.6: Improper Authentication
Keycloak provides a way to let users log in using Microsoft accounts while restricting access to a specific organization (tenant). A flaw was discovered where this restriction is ignored when using the token exchange feature. This means an attacker with a vali
- 8.1 High severity
Red Hat build of Keycloak 26.6: Missing Authorization
Keycloak allows users to log in using Google accounts and can be configured to only allow users from specific Google Workspace domains. A flaw was found where the token exchange feature, which allows swapping a Google token for a Keycloak token, does not check