Redhat Build Of Keycloak vulnerabilities

CVE-2024-7260 [MEDIUM] CWE-601 CVE-2024-7260: An open redirect vulnerability was found in Keycloak. A specially crafted URL can be constructed whe An open redirect vulnerability was found in Keycloak. A specially crafted URL can be constructed where the referrer and referrer_uri parameters are made to trick a user to visit a malicious webpage. A trusted URL can trick users and automation into believing that the URL is safe, when, in fact, it redirects to a malicious server. This issue can result

CVE-2026-3429 [MEDIUM] CWE-284 CVE-2026-3429: A flaw was identified in the Account REST API of Keycloak that allows a user authenticated at a lowe A flaw was identified in the Account REST API of Keycloak that allows a user authenticated at a lower security level to perform sensitive actions intended only for higher-assurance sessions. Specifically, an attacker who has already obtained a victim’s password can delete the victim’s registered MFA/OTP credential without first proving possession of t

CVE-2024-7318 [MEDIUM] CWE-324 CVE-2024-7318: A vulnerability was found in Keycloak. Expired OTP codes are still usable when using FreeOTP when th A vulnerability was found in Keycloak. Expired OTP codes are still usable when using FreeOTP when the OTP token period is set to 30 seconds (default). Instead of expiring and deemed unusable around 30 seconds in, the tokens are valid for an additional 30 seconds totaling 1 minute. A one time passcode that is valid longer than its expiration time incre

CVE-2025-12150 [LOW] CWE-347 CVE-2025-12150: A flaw was found in Keycloak’s WebAuthn registration component. This vulnerability allows an attacke A flaw was found in Keycloak’s WebAuthn registration component. This vulnerability allows an attacker to bypass the configured attestation policy and register untrusted or forged authenticators via submission of an attestation object with fmt: "none", even when the realm is configured to require direct attestation. This can lead to weakened authenticat

CVE-2026-2366 [LOW] CWE-639 CVE-2026-2366: A flaw was found in Keycloak. An authorization bypass vulnerability in the Keycloak Admin API allows A flaw was found in Keycloak. An authorization bypass vulnerability in the Keycloak Admin API allows any authenticated user, even those without administrative privileges, to enumerate the organization memberships of other users. This information disclosure occurs if the attacker knows the victim's unique identifier (UUID) and the Organizations feature is

CVE-2026-14615 [LOW] CWE-1220 CVE-2026-14615: A flaw was found in the Fine-Grained Admin Permissions (FGAP) v2 implementation within Keycloak's ad A flaw was found in the Fine-Grained Admin Permissions (FGAP) v2 implementation within Keycloak's administrative services. When FGAP v2 is enabled, the system fails to properly filter child groups based on the caller's specific permissions when requested through a parent group. This allows a delegated administrator to view details of child groups they

CVE-2026-3911 [LOW] CWE-359 CVE-2026-3911: A flaw was found in Keycloak. An authenticated user with the view-users role could exploit a vulnera A flaw was found in Keycloak. An authenticated user with the view-users role could exploit a vulnerability in the UserResource component. By accessing a specific administrative endpoint, this user could improperly retrieve user attributes that were configured to be hidden. This unauthorized information disclosure could expose sensitive user data.