Red Hat build of Keycloak 26.6 vulnerabilities
49 known vulnerabilities in Red Hat build of Keycloak 26.6 from Red Hat. 49 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 7.7 High severity
Red Hat build of Keycloak 26.4: Authorization Bypass Through User-Controlled Key
A flaw was found in Keycloak. A missing authorization check in the GroupResource.addChild() endpoint within the Admin REST API allows an authenticated user with limited administrative privileges to reparent any existing group. When Fine-Grained Admin Permissio
- 7.3 High severity
Red Hat build of Keycloak 26.4: Improper Neutralization of Input During Web Page Generation
A flaw was found in Keycloak. A remote attacker with administrative privileges, specifically those with `manage-client` permission or access to client registration endpoints, could bypass client Uniform Resource Identifier (URI) validation. This is achieved by
- 8.1 High severity
jackson-databind: Incomplete List of Disallowed Inputs
jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8, 2.21.4, and 3.1.4, BasicPolymorphicTypeValidator.Builder.allowIfSubTypeIsArray() allowlists any array type based only
- 7.5 High severity
Micrometer: Uncontrolled Resource Consumption
In Micrometer, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) condition. Affected versions: micrometer-core 1.16.0 through 1.16.5; 1.15.0 through 1.15.11; 1.14.0 through 1.14.15; 1.13.0 through 1.1
- 7.5 High severity
Micrometer: Uncontrolled Resource Consumption
In Micrometer, it is possible for a user to provide specially crafted gRPC requests that may cause a denial-of-service (DoS) condition. Affected versions: Micrometer 1.16.0 through 1.16.5; 1.15.0 through 1.15.11.
- 7.3 High severity
Red Hat build of Keycloak 26.4: Incorrect Privilege Assignment
A flaw was found in Keycloak's Fine-Grained Admin Permissions (FGAPv2) feature. An administrator with limited client management permissions can exploit this vulnerability to assign any realm role, including highly privileged roles, to a client's scope mapping.
- 7.5 High severity
Red Hat build of Keycloak 26.4: Improper Verification of Cryptographic Signature
A flaw was found in Keycloak. When a JSON Web Encryption (JWE) encrypted request object is submitted, Keycloak may incorrectly process unsigned claims if the decrypted content is raw JSON, bypassing the configured signature policy. This allows a remote attacke
- 8.8 High severity
Red Hat build of Keycloak 26.4: Improper Validation of Specified Quantity in Input
A flaw was found in Keycloak. An authenticated user with low privileges can exploit this vulnerability by sending an oversized subject_token JSON Web Token (JWT) to the TokenEndpoint. When the token exceeds a 4000-character limit, it is silently dropped, causi
- 8.1 High severity
Red Hat build of Keycloak 26.4: Authorization Bypass Through User-Controlled Key
A flaw was found in Keycloak. The cross-session verification proof is keyed only by (local userId, idpAlias) and is not bound to the upstream identity that was actually verified, so a second upstream account on the same IdP can consume it and get linked to the