{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "New Red Hat build of Keycloak 26.6.8 packages are available from the Customer Portal",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Red Hat build of Keycloak 26.6.8 is a standalone server, based on\nthe Keycloak project, that provides authentication and\nstandards-based single sign-on capabilities for web and mobile\napplications.\n\nSecurity fixes:\n* keycloak-services: keycloak-services: Unbounded metric series creation via idp tag on broker login endpoint (CVE-2026-101333)\n* keycloak-services: keycloak-services: Account takeover via authentication race using reset-credentials path (CVE-2026-103112)\n* rhbk/keycloak-rhel9: keycloak-services: Path traversal in X.509 CRL Distribution Point allows arbitrary local file read (CVE-2026-103884)\n* keycloak-services: keycloak-services: Device Authorization Grant bypasses per-client minimum.acr.value enforcement (CVE-2026-105305)\n* keycloak-services: keycloak-services: SMTP STARTTLS plaintext credential and message downgrade (CVE-2026-107121)\n* keycloak-services: keycloak-services: Unauthenticated CPU denial of service via SAML XML dateTime and duration parsing (CVE-2026-107123)\n* keycloak-services: keycloak-services: OIDC logout endpoint session fixation via id_token_hint leading to account takeover (CVE-2026-107124)\n* keycloak-services: keycloak-services: Unauthenticated CPU exhaustion via SAML 1.1 KeyInfo infinite loop (CVE-2026-107602)\n* keycloak-services: keycloak-services: OIDC DCR read-modify-write silently disables offline token revocation (CVE-2026-107623)\n* keycloak-services: keycloak-services: Stored XSS on login page via kcSanitize bypass (CVE-2026-107889)\n* keycloak-services: keycloak-services: Injection of roles into realm default-roles via DCR endpoint (CVE-2026-109081)\n* rhbk/keycloak-rhel9-operator: Jackson-databind: PolymorphicTypeValidator bypass via generic type arguments and array element types in jackson-databind allows arbitrary class instantiation (incomplete fix for CV (CVE-2026-110879)\n* keycloak-services: keycloak-services: Unauthenticated JVM termination via SAML 1.1 AuthorityBinding parsing loop (CVE-2026-110931)\n* keycloak-services: keycloak-services: Unauthenticated persistent disk exhaustion via theme gzip cache (CVE-2026-110932)\n* keycloak-services: keycloak-services: Account takeover via stale SSO_AUTH note in Organization identity-first login (CVE-2026-112208)\n* keycloak-services: keycloak-services: UMA Protection API resourceType field not validated \u2014 cross-owner resource access (CVE-2026-114232)\n* rhbk/keycloak-rhel9: Keycloak: Privilege escalation to realm administrator via improper authorization in identity provider mapper (CVE-2026-12388)\n* rhbk/keycloak-rhel9: Bouncy Castle for Java: Cryptographic signature bypass in RSA PKCS#1 verification (CVE-2026-12860)\n* bcprov-jdk18on: Bouncy Castle for Java: Denial of Service via lazy ASN.1 sequence processing (CVE-2026-13506)\n* rhbk-openshift-rhel9/rhbk-openshift-rhel9: keycloak-services: OIDC IdP update reuses masked client secret after token URL change (CVE-2026-15943)\n* rhbk-openshift-rhel9/rhbk-openshift-rhel9: keycloak-services: Incomplete fix for CIBA brute-force lockout bypass at token redemption (CVE-2026-16103)\n* rhbk-openshift-rhel9/rhbk-openshift-rhel9: keycloak-services: Group policy extendChildren matches sibling group path prefixes (CVE-2026-18203)\n* rhbk-openshift-rhel9/rhbk-openshift-rhel9: keycloak-services: Client policy source-host wildcard domain matching bypass (CVE-2026-18206)\n* rhbk-openshift-rhel9/rhbk-openshift-rhel9: keycloak-services: Client policy source-group condition bypass via duplicate group name matching (CVE-2026-18207)\n* rhbk-openshift-rhel9/rhbk-openshift-rhel9: keycloak-services: Inactive out-of-audience token introspection leaks signed JWT claim (CVE-2026-18208)\n* rhbk-openshift-rhel9/rhbk-openshift-rhel9: keycloak-services: SAML HTTP-Redirect binding response preserves query string leading to parameter pollution (CVE-2026-18217)\n* rhbk-openshift-rhel9/rhbk-openshift-rhel9: keycloak-services: OIDC backchannel logout accepts unsigned forged logout tokens (CVE-2026-18569)\n* rhbk-openshift-rhel9/rhbk-openshift-rhel9: keycloak-services: Name-only group claims let same-name groups satisfy path-specific group policies (CVE-2026-19608)\n* keycloak/rhbk-openshift-rhel9: wildfly-elytron: Password keyspace reduction via NFKC fullwidth folding (CVE-2026-19611)\n* rhbk-openshift-rhel9/rhbk-openshift-rhel9: keycloak-services: Admin API missing audience check (CVE-2026-19688)\n* rhbk/keycloak-rhel9: Bouncy Castle for Java: Denial of Service via quadratic-time escaping of X.500 distinguished names (CVE-2026-58059)\n* rhbk/keycloak-rhel9: Netty: Information disclosure via CORS Vary header overwrite (CVE-2026-59903)\n* netty-handler: Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext (CVE-2026-75595)\n* rhbk-openshift-rhel9/rhbk-openshift-rhel9: Hibernate ORM: SQL Injection via unescaped JSON path segment allows data exfiltration and authorization bypass (CVE-2026-77874)\n* keycloak/rhbk-openshift-rhel9: keycloak-services: Unauthenticated Denial of Service via SAML SOAP endpoint unbounded XML parsing (CVE-2026-82965)\n* keycloak/rhbk-openshift-rhel9: keycloak-services: Cross-session email verification proof not bound to upstream identity for social providers (CVE-2026-82968)\n* bcpkix-jdk18on: Bouncy Castle for Java: Name Constraints bypass via trailing dot in rfc822Name and URI (CVE-2026-8763)\n* keycloak/rhbk-openshift-rhel9: keycloak-services: Device Authorization Grant issues tokens to brute-force-locked accounts (CVE-2026-88770)\n* rhbk/keycloak-rhel9: keycloak-services: Confidential client secret disclosed to view-clients role via Client Registration GET (CVE-2026-89298)\n* rhbk/keycloak-rhel9-operator: jackson-databind: Denial of Service via unbounded cache growth in TypeDeserializerBase (CVE-2026-91776)\n* jackson-databind: Jackson-databind: Denial of Service via quadratic forward-reference completion (CVE-2026-91777)\n* keycloak/rhbk-openshift-rhel9: keycloak-services: Residual cross-browser account-link proof allows silent re-linking (CVE-2026-92358)\n* keycloak/rhbk-openshift-rhel9: keycloak-services: SAML broker accepts holder-of-key assertions without proof of key possession (CVE-2026-92855)\n* keycloak/rhbk-openshift-rhel9: keycloak-services: SAML broker ignores ProxyRestriction delegation constraints (CVE-2026-92856)\n* keycloak/rhbk-openshift-rhel9: keycloak-services: DCR protocol mapper config not validated, allowing IAT holders to forge sub and aud claims in signed tokens (CVE-2026-92857)\n* netty-codec-http: Netty: Denial of Service via unbounded concurrent SPDY streams (CVE-2026-93488)\n* netty-codec-http: Netty: Denial of Service via unbounded HttpServerCodec HTTP/1.1 pipeline queue (CVE-2026-93491)\n* netty-codec-http2: Netty: HTTP/2 HpackEncoder DoS with large table size (CVE-2026-93492)\n* netty-codec-http: Netty: Unbounded Per-Connection Queue Growth in WebSocketServerExtensionHandler Leads to Denial of Service (CVE-2026-93558)\n* netty-codec-http: Netty: Incomplete validation of malformed Transfer-Encoding allows HTTP request smuggling (CVE-2026-93562)\n* netty-codec-haproxy: Netty: HAProxy PROXY-v2 nested-TLV grandchild ByteBuf reference-count leak (incomplete fix of PR #16881) (CVE-2026-93564)\n* netty-codec-http: Netty RtspDecoder Method-Token Smuggling via Trailing Control Byte (CVE-2026-93565)\n* netty-codec-http: Netty: HTTP Request Smuggling due to control characters in the chunk-size line (CVE-2026-93566)\n* netty-codec-http2: HTTP/1 authority-form CONNECT is translated to malformed HTTP/2 CONNECT with Host-controlled :authority (CVE-2026-93567)\n* netty-codec-http2: Netty: HTTP/2 and HTTP/3 Extended CONNECT requests are downgraded as regular CONNECT requests (CVE-2026-93568)\n* netty-codec-http2: HTTP/1 absolute-form Host mismatch is translated to HTTP/2 :authority, overriding the request-target authority (CVE-2026-93569)\n* netty-codec-http: Netty split Transfer-Encoding fields bypass final-chunked validation and enable request smuggling (CVE-2026-93573)\n* netty-codec-http: Netty: HTTP request smuggling via post-digit whitespace in chunk-size parsing (CVE-2026-93574)\n* netty-codec-http2: Netty: HTTP/2 header field values are not validated by default (CR/LF/NUL passthrough) (CVE-2026-93579)\n* keycloak/rhbk-rhel9-operator: keycloak-core: SAML adapter does not bind signed assertions to the configured identity provider issuer (CVE-2026-93998)\n* keycloak/rhbk-openshift-rhel9: keycloak-services: Token refresh continues issuing tokens for disabled audience clients (CVE-2026-93999)\n* keycloak/rhbk-openshift-rhel9: keycloak-services: Delegated admin with manage-users can escalate to realm-admin via group membership (CVE-2026-94000)\n* keycloak/rhbk-openshift-rhel9: keycloak-services: Admin credential DELETE bypasses denied reset-password permission (CVE-2026-94001)\n* keycloak/rhbk-openshift-rhel9: keycloak-services: Authorization Services policy evaluation endpoint leaks user identity (CVE-2026-94213)\n* keycloak/rhbk-openshift-rhel9: keycloak-services: Cross-realm client read/write via request-level cache missing realm ownership check (CVE-2026-94215)\n* keycloak/rhbk-openshift-rhel9: keycloak-services: UMA scope merge across resource owners via resource name collision (CVE-2026-94217)\n* keycloak/rhbk-openshift-rhel9: keycloak-services: 2FA setup enforcement bypass via authentication session restart endpoint (CVE-2026-94218)\n* keycloak/rhbk-openshift-rhel9: keycloak-services: Potential KDC spoofing bypass when Kerberos password authentication is enabled (CVE-2026-95503)\n* keycloak-services: keycloak-services: Conditional OTP skip-header policy evaluated against untrusted proxy headers (CVE-2026-96445)\n* keycloak-services: keycloak-services: PAR single-use bypass via prompt=none silent authentication path (CVE-2026-96446)\n* keycloak-services: keycloak-services: Stateless token preferred_username fallback enables identity rebinding (CVE-2026-96447)\n* keycloak-services: keycloak-services: FGAP v2 composite-blind role mapping allows privilege escalation (CVE-2026-96448)\n* keycloak-admin-cli: keycloak-admin-cli: kcadm custom truststore accepts arbitrary self-signed certificates (CVE-2026-96453)\n* keycloak-services: keycloak-services: Indefinite access token renewal via Standard Token Exchange V2 (CVE-2026-96460)\n* keycloak-services: keycloak-services: DCR registration-time claim-path gap allows forging realm_access.roles (CVE-2026-96547)\n* keycloak-services: keycloak-services: CIBA sub parameter injection causes attacker authentication to issue victim tokens (CVE-2026-97174)\n* keycloak-services: keycloak-services: Unverified IdP email auto-linking enables account takeover (CVE-2026-97175)\n* keycloak-services: keycloak-services: Generic user update bypasses denied reset-password permission (CVE-2026-97177)\n* keycloak-services: keycloak-services: Admin REST API role-groups endpoint discloses groups without authorization (CVE-2026-97311)\n* keycloak-services: keycloak-services: DCR azp and sid claim substitution allows Account REST session takeover (CVE-2026-97367)\n* keycloak-services: keycloak-services: Standard Token Exchange V2 bypasses mTLS holder-of-key binding (CVE-2026-97846)\n* keycloak-services: keycloak-services: Client manager can substitute sessionless token principal via hardcoded-claim mappers to obtain realm administrator authority (CVE-2026-97847)\n* keycloak-services: keycloak-services: Protocol mapper with jsonType=JSON bypasses token sanitization (CVE-2026-97848)",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:95761",
        "url": "https://access.redhat.com/errata/RHSA-2026:95761"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_95761.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat build of Keycloak 26.6.8 Security Update",
    "tracking": {
      "current_release_date": "2026-11-06T10:29:13+00:00",
      "generator": {
        "date": "2026-11-06T10:29:13+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.4.5"
        }
      },
      "id": "RHSA-2026:95761",
      "initial_release_date": "2026-11-06T10:21:57+00:00",
      "revision_history": [
        {
          "date": "2026-11-06T10:21:57+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-11-06T10:21:57+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-11-06T10:29:13+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat build of Keycloak 26.6.8",
                "product": {
                  "name": "Red Hat build of Keycloak 26.6.8",
                  "product_id": "Red Hat build of Keycloak 26.6.8",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:build_keycloak:26.6::el9"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat build of Keycloak"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-8763",
      "cwe": {
        "id": "CWE-295",
        "name": "Improper Certificate Validation"
      },
      "discovery_date": "2026-08-03T02:01:23.973629+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2510198"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Bouncy Castle for Java, a cryptographic library. An attacker can exploit this vulnerability by manipulating rfc822Name and URI fields within X.509 certificates using a trailing dot. This bypasses Name Constraints, potentially leading to spoofing or unauthorized access. Such an exploit impacts the integrity and confidentiality of communications.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "org.bouncycastle/bcprov-jdk15on: org.bouncycastle/bcpkix-jdk15on: Bouncy Castle for Java: Name Constraints bypass via trailing dot in rfc822Name and URI",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important flaw in Bouncy Castle for Java, a cryptographic library used across various Red Hat products. The vulnerability allows an attacker to bypass Name Constraints in X.509 certificates by manipulating rfc822Name and URI fields with a trailing dot. This bypass could lead to spoofing or unauthorized access, impacting the integrity and confidentiality of communications in affected Red Hat environments.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat build of Keycloak 26.6.8"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-8763"
        },
        {
          "category": "external",
          "summary": "RHBZ#2510198",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2510198"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-8763",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-8763"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-8763",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-8763"
        },
        {
          "category": "external",
          "summary": "https://github.com/bcgit/bc-java/commit/2c28b253a44681fbbc562561eab6ad383d2ae558",
          "url": "https://github.com/bcgit/bc-java/commit/2c28b253a44681fbbc562561eab6ad383d2ae558"
        },
        {
          "category": "external",
          "summary": "https://github.com/bcgit/bc-java/wiki/CVE-2026-8763",
          "url": "https://github.com/bcgit/bc-java/wiki/CVE-2026-8763"
        }
      ],
      "release_date": "2026-08-03T00:36:05.088000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-06T10:21:57+00:00",
          "details": "Before applying the update, back up your existing installation,\nincluding all applications, configuration files, databases and\ndatabase settings, and so on.",
          "product_ids": [
            "Red Hat build of Keycloak 26.6.8"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:95761"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat build of Keycloak 26.6.8"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "org.bouncycastle/bcprov-jdk15on: org.bouncycastle/bcpkix-jdk15on: Bouncy Castle for Java: Name Constraints bypass via trailing dot in rfc822Name and URI"
    },
    {
      "cve": "CVE-2026-12388",
      "cwe": {
        "id": "CWE-266",
        "name": "Incorrect Privilege Assignment"
      },
      "discovery_date": "2026-06-10T14:45:28+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2489140"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Identity Provider (IdP) mapper component of Keycloak, which is used to manage how user information from external services is mapped to Keycloak users. An administrator with limited permissions to manage identity providers can exploit this flaw by creating a \"Hardcoded Role\" mapper that assigns high-level administrative roles (like realm-admin) to themselves or others. This allows a restricted administrator to bypass security checks and gain full control over the entire realm.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "keycloak-broker: Keycloak: Privilege escalation to realm administrator via improper authorization in identity provider mapper",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "The Red Hat Product Security team has assessed the severity of this vulnerability as Moderate, given that it requires the attacker to already possess high-level administrative privileges (manage-identity-providers). Successful exploitation allows an attacker to escalate their privileges to realm-admin, granting them full control over the Keycloak realm. The vulnerability\u0027s root cause is a failure to enforce proper authorization checks (specifically requireMapRole) within the Identity Provider mapper endpoint.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat build of Keycloak 26.6.8"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-12388"
        },
        {
          "category": "external",
          "summary": "RHBZ#2489140",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2489140"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-12388",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-12388"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-12388",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-12388"
        }
      ],
      "release_date": "2026-06-30T11:49:29.358000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-06T10:21:57+00:00",
          "details": "Before applying the update, back up your existing installation,\nincluding all applications, configuration files, databases and\ndatabase settings, and so on.",
          "product_ids": [
            "Red Hat build of Keycloak 26.6.8"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:95761"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat build of Keycloak 26.6.8"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat build of Keycloak 26.6.8"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "keycloak-broker: Keycloak: Privilege escalation to realm administrator via improper authorization in identity provider mapper"
    },
    {
      "cve": "CVE-2026-12860",
      "cwe": {
        "id": "CWE-347",
        "name": "Improper Verification of Cryptographic Signature"
      },
      "discovery_date": "2026-08-03T04:01:02.591427+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2510256"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Bouncy Castle for Java. During the RSA PKCS#1 verification process, the last two hash bytes are incorrectly skipped when a NULL-omitted path is utilized. This vulnerability could allow an attacker to bypass cryptographic signature verification, potentially leading to the acceptance of forged or malicious data as authentic.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "org.bouncycastle/bc-java: org.bouncycastle/bc-lts-java: Bouncy Castle for Java: Cryptographic signature bypass in RSA PKCS#1 verification",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "A signature verification flaw was found in Bouncy Castle for Java\u0027s RSA PKCS#1 parser (`bcprov`). When verifying RSA PKCS#1 v1.5 signatures utilizing a NULL-omitted DigestInfo path, the verification routine incorrectly skips the last two bytes of the expected digest hash. An unauthenticated remote attacker can exploit this truncated comparison to craft forged signatures that pass verification, bypassing cryptographic integrity controls.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat build of Keycloak 26.6.8"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-12860"
        },
        {
          "category": "external",
          "summary": "RHBZ#2510256",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2510256"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-12860",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-12860"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-12860",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-12860"
        },
        {
          "category": "external",
          "summary": "https://github.com/bcgit/bc-java/commit/ea5970ea9b2fb91d763b904692fd21089ca3e396",
          "url": "https://github.com/bcgit/bc-java/commit/ea5970ea9b2fb91d763b904692fd21089ca3e396"
        },
        {
          "category": "external",
          "summary": "https://github.com/bcgit/bc-java/wiki/CVE-2026-12860",
          "url": "https://github.com/bcgit/bc-java/wiki/CVE-2026-12860"
        }
      ],
      "release_date": "2026-08-03T02:55:58.379000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-06T10:21:57+00:00",
          "details": "Before applying the update, back up your existing installation,\nincluding all applications, configuration files, databases and\ndatabase settings, and so on.",
          "product_ids": [
            "Red Hat build of Keycloak 26.6.8"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:95761"
        },
        {
          "category": "workaround",
          "details": "Enforce strict DigestInfo encoding checks requiring explicit ASN.1 NULL parameters in RSA PKCS#1 v1.5 signature verification, or mandate the use of RSA-PSS signature schemes in application TLS/crypto configuration.",
          "product_ids": [
            "Red Hat build of Keycloak 26.6.8"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat build of Keycloak 26.6.8"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "org.bouncycastle/bc-java: org.bouncycastle/bc-lts-java: Bouncy Castle for Java: Cryptographic signature bypass in RSA PKCS#1 verification"
    },
    {
      "cve": "CVE-2026-13506",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-08-03T04:01:05.710651+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2510257"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Bouncy Castle for Java. A remote attacker could exploit a vulnerability related to how the software processes lazy ASN.1 sequences, which can reset an internal nesting-depth guard. This issue could lead to a Denial of Service (DoS), making the affected system or application unavailable.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "bouncycastle: Bouncy Castle for Java: Denial of Service via lazy ASN.1 sequence processing",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Important flaw in Bouncy Castle for Java can lead to a denial of service. A remote attacker could exploit a vulnerability in how lazy ASN.1 sequences are processed, allowing the resetting of an internal nesting-depth guard. This could result in resource exhaustion and make affected applications unavailable.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat build of Keycloak 26.6.8"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-13506"
        },
        {
          "category": "external",
          "summary": "RHBZ#2510257",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2510257"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-13506",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-13506"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-13506",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-13506"
        },
        {
          "category": "external",
          "summary": "https://github.com/bcgit/bc-java/commit/77454da9b3dcaaa2991412d1c3c1a6e1a338ff84",
          "url": "https://github.com/bcgit/bc-java/commit/77454da9b3dcaaa2991412d1c3c1a6e1a338ff84"
        },
        {
          "category": "external",
          "summary": "https://github.com/bcgit/bc-java/wiki/CVE-2026-13506",
          "url": "https://github.com/bcgit/bc-java/wiki/CVE-2026-13506"
        }
      ],
      "release_date": "2026-08-03T02:56:49.476000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-06T10:21:57+00:00",
          "details": "Before applying the update, back up your existing installation,\nincluding all applications, configuration files, databases and\ndatabase settings, and so on.",
          "product_ids": [
            "Red Hat build of Keycloak 26.6.8"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:95761"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat build of Keycloak 26.6.8"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat build of Keycloak 26.6.8"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "bouncycastle: Bouncy Castle for Java: Denial of Service via lazy ASN.1 sequence processing"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Paul Bottinelli"
          ],
          "organization": "Trail of Bits in collaboration with OpenAI"
        }
      ],
      "cve": "CVE-2026-15943",
      "cwe": {
        "id": "CWE-1288",
        "name": "Improper Validation of Consistency within Input"
      },
      "discovery_date": "2026-07-16T06:27:49+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2501270"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Keycloak keycloak-services component, which handles the management of identity providers. The issue occurs when a delegated administrator updates an OIDC identity provider using a masked client secret sentinel value. Due to improper validation, Keycloak reuses the existing real secret even if security-sensitive fields like the token URL have been changed, allowing an attacker to redirect and capture the secret.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "keycloak-services: keycloak-services: OIDC IdP update reuses masked client secret after token URL change",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "The Red Hat Product Security team has assessed the severity of this vulnerability as Moderate, given that it requires high administrative privileges to exploit. Successful exploitation allows an attacker to rebind and capture an OIDC client secret by modifying identity provider configuration fields. The vulnerability\u0027s root cause is the unconditional reuse of masked secrets during configuration updates without verifying if sensitive endpoint fields have changed.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat build of Keycloak 26.6.8"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-15943"
        },
        {
          "category": "external",
          "summary": "RHBZ#2501270",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2501270"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-15943",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-15943"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-15943",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-15943"
        }
      ],
      "release_date": "2026-07-16T06:27:49+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-06T10:21:57+00:00",
          "details": "Before applying the update, back up your existing installation,\nincluding all applications, configuration files, databases and\ndatabase settings, and so on.",
          "product_ids": [
            "Red Hat build of Keycloak 26.6.8"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:95761"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat build of Keycloak 26.6.8"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "keycloak-services: keycloak-services: OIDC IdP update reuses masked client secret after token URL change"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "johanw"
          ]
        }
      ],
      "cve": "CVE-2026-16103",
      "cwe": {
        "id": "CWE-305",
        "name": "Authentication Bypass by Primary Weakness"
      },
      "discovery_date": "2026-07-16T16:53:46+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2501736"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the keycloak-services component of Keycloak. This issue is an incomplete fix for CVE-2026-9798, where brute-force protection checks were added to the Client-Initiated Backchannel Authentication (CIBA) initiation handler but were omitted from the token redemption handler. This allows an attacker with valid client credentials to obtain access and refresh tokens for a user account that has been locked due to brute-force protection, provided the authentication request was started before the lockout occurred and was approved by the user.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "keycloak-services: keycloak-services: Incomplete fix for CIBA brute-force lockout bypass at token redemption",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "The Red Hat Product Security team has assessed the severity of this vulnerability as Moderate, given that successful exploitation allows an attacker to obtain a valid user session for an account that should be temporarily disabled by brute-force protection. Successful exploitation requires a CIBA request to be in flight prior to the account lockout and necessitates user interaction for approval. The vulnerability\u0027s root cause is the omission of brute-force protector checks in the CIBA grant redemption code path.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat build of Keycloak 26.6.8"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-16103"
        },
        {
          "category": "external",
          "summary": "RHBZ#2501736",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2501736"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-16103",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-16103"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-16103",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-16103"
        }
      ],
      "release_date": "2026-07-16T16:53:46+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-06T10:21:57+00:00",
          "details": "Before applying the update, back up your existing installation,\nincluding all applications, configuration files, databases and\ndatabase settings, and so on.",
          "product_ids": [
            "Red Hat build of Keycloak 26.6.8"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:95761"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat build of Keycloak 26.6.8"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat build of Keycloak 26.6.8"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "keycloak-services: keycloak-services: Incomplete fix for CIBA brute-force lockout bypass at token redemption"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Paul Bottinelli"
          ],
          "organization": "Trail of Bits in collaboration with OpenAI"
        }
      ],
      "cve": "CVE-2026-18203",
      "cwe": {
        "id": "CWE-863",
        "name": "Incorrect Authorization"
      },
      "discovery_date": "2026-07-28T13:44:55+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2508291"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the group policy evaluation logic of Keycloak, an identity and access management solution. When a group policy is set to extend permissions to child groups, the system incorrectly uses a simple text-based prefix check to verify group membership. This allows a user who belongs to a different group with a similar starting name to bypass security checks and gain unauthorized access to administrative functions or protected resources.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "keycloak-services: keycloak-services: Group policy extendChildren matches sibling group path prefixes",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "The Red Hat Product Security team has assessed the severity of this vulnerability as Moderate, given that exploitation requires a specific group naming collision and the extendChildren policy setting to be active. Successful exploitation allows an attacker to gain unauthorized integrity-impacting permissions within the realm. The vulnerability\u0027s root cause is an improper string prefix comparison during group path validation in the authorization services.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat build of Keycloak 26.6.8"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-18203"
        },
        {
          "category": "external",
          "summary": "RHBZ#2508291",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2508291"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-18203",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-18203"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-18203",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-18203"
        }
      ],
      "release_date": "2026-07-28T13:44:55+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-06T10:21:57+00:00",
          "details": "Before applying the update, back up your existing installation,\nincluding all applications, configuration files, databases and\ndatabase settings, and so on.",
          "product_ids": [
            "Red Hat build of Keycloak 26.6.8"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:95761"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat build of Keycloak 26.6.8"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat build of Keycloak 26.6.8"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "keycloak-services: keycloak-services: Group policy extendChildren matches sibling group path prefixes"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Paul Bottinelli"
          ],
          "organization": "Trail of Bits in collaboration with OpenAI"
        }
      ],
      "cve": "CVE-2026-18206",
      "cwe": {
        "id": "CWE-20",
        "name": "Improper Input Validation"
      },
      "discovery_date": "2026-07-28T13:36:46+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2508292"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the keycloak-services component of Keycloak, which provides identity and access management services. The issue occurs when a realm administrator uses a wildcard domain (like *.example.com) to restrict which hosts can register or update clients. Due to improper validation, the system accepts any hostname that ends with the specified domain suffix, even if it is not a legitimate subdomain. An attacker who can control the reverse DNS of their connection can bypass these host-based restrictions, potentially allowing unauthorized client modifications.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "keycloak-services: keycloak-services: Client policy source-host wildcard domain matching bypass",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "The Red Hat Product Security team has assessed the severity of this vulnerability as Low, given that exploitation requires a specific administrative configuration and attacker control over reverse DNS resolution. Successful exploitation allows an attacker to bypass host-based restrictions for client registration and update operations. The vulnerability\u0027s root cause is improper validation of wildcard domain matches in the keycloak-services component, which fails to enforce proper subdomain boundaries.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat build of Keycloak 26.6.8"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-18206"
        },
        {
          "category": "external",
          "summary": "RHBZ#2508292",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2508292"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-18206",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-18206"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-18206",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-18206"
        }
      ],
      "release_date": "2026-07-28T13:36:46+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-06T10:21:57+00:00",
          "details": "Before applying the update, back up your existing installation,\nincluding all applications, configuration files, databases and\ndatabase settings, and so on.",
          "product_ids": [
            "Red Hat build of Keycloak 26.6.8"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:95761"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat build of Keycloak 26.6.8"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat build of Keycloak 26.6.8"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "keycloak-services: keycloak-services: Client policy source-host wildcard domain matching bypass"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Paul Bottinelli"
          ],
          "organization": "Trail of Bits in collaboration with OpenAI"
        }
      ],
      "cve": "CVE-2026-18207",
      "cwe": {
        "id": "CWE-285",
        "name": "Improper Authorization"
      },
      "discovery_date": "2026-07-28T13:33:21+00:00",
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the client policy enforcement mechanism of Keycloak. The issue occurs when the system checks group membership by name instead of a unique identifier. An attacker with client management privileges could bypass security policies by joining a group with a matching name in a different part of the group hierarchy, potentially allowing them to register or update clients without following required security hardening profiles.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "keycloak-services: keycloak-services: Client policy source-group condition bypass via duplicate group name matching",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "The Red Hat Product Security team has assessed the severity of this vulnerability as Moderate, given that exploitation requires the attacker to have existing client registration or update privileges and a specific group hierarchy configuration. Successful exploitation allows an attacker to bypass client policy enforcement and register or update clients without required security hardening. The vulnerability\u0027s root cause is the use of non-unique group names for membership validation in client policy conditions.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat build of Keycloak 26.6.8"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-18207"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-18207",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-18207"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-18207",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-18207"
        }
      ],
      "release_date": "2026-07-28T13:33:21+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-06T10:21:57+00:00",
          "details": "Before applying the update, back up your existing installation,\nincluding all applications, configuration files, databases and\ndatabase settings, and so on.",
          "product_ids": [
            "Red Hat build of Keycloak 26.6.8"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:95761"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat build of Keycloak 26.6.8"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat build of Keycloak 26.6.8"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "keycloak-services: keycloak-services: Client policy source-group condition bypass via duplicate group name matching"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Paul Bottinelli"
          ],
          "organization": "Trail of Bits in collaboration with OpenAI"
        }
      ],
      "cve": "CVE-2026-18208",
      "cwe": {
        "id": "CWE-862",
        "name": "Missing Authorization"
      },
      "discovery_date": "2026-07-28T13:29:44+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2508304"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the OIDC token introspection endpoint of the keycloak-services component. Keycloak is an open-source identity and access management solution used to secure modern applications and services. The issue occurs when a confidential client, configured to receive signed JWT introspection responses, attempts to introspect a token issued for a different audience. Although the endpoint correctly identifies the token as inactive for that client, it still returns the full set of token claims within a signed JWT field. This allows an unauthorized client to bypass audience-based restrictions and access sensitive information contained in the token.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "keycloak-services: keycloak-services: Inactive out-of-audience token introspection leaks signed JWT claim",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "The Red Hat Product Security team has assessed the severity of this vulnerability as Moderate, given that exploitation requires the attacker to control a confidential client within the same realm and possess a valid token issued for a different audience. Successful exploitation allows an attacker to recover sensitive token claims that should be restricted by audience-based access controls. The vulnerability\u0027s root cause is a failure to sanitize the signed JWT field in the introspection response when a token is determined to be inactive due to an audience mismatch.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat build of Keycloak 26.6.8"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-18208"
        },
        {
          "category": "external",
          "summary": "RHBZ#2508304",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2508304"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-18208",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-18208"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-18208",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-18208"
        }
      ],
      "release_date": "2026-07-28T13:29:44+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-06T10:21:57+00:00",
          "details": "Before applying the update, back up your existing installation,\nincluding all applications, configuration files, databases and\ndatabase settings, and so on.",
          "product_ids": [
            "Red Hat build of Keycloak 26.6.8"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:95761"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat build of Keycloak 26.6.8"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat build of Keycloak 26.6.8"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "keycloak-services: keycloak-services: Inactive out-of-audience token introspection leaks signed JWT claim"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "yd1ng"
          ]
        }
      ],
      "cve": "CVE-2026-18217",
      "cwe": {
        "id": "CWE-20",
        "name": "Improper Input Validation"
      },
      "discovery_date": "2026-07-28T12:03:23+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2508311"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the SAML protocol implementation of Keycloak, an open-source identity and access management solution. The issue occurs when Keycloak handles SAML authentication requests using the HTTP-Redirect binding. If a client is configured with a wildcard redirect URL, an attacker can craft a request that includes malicious parameters. When a user authenticates, Keycloak appends its legitimate response to the attacker\u0027s parameters. This can cause some service providers to process the attacker\u0027s data instead of the real login information, potentially leading to a user being logged into the wrong account.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "keycloak-services: keycloak-services: SAML HTTP-Redirect binding response preserves query string leading to parameter pollution",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "The Red Hat Product Security team has assessed the severity of this vulnerability as Moderate, given that exploitation requires a specific client configuration (wildcard redirect URIs) and a downstream service provider that incorrectly handles duplicate HTTP parameters. Successful exploitation allows an attacker to perform login CSRF or session swapping on the affected service provider. The vulnerability\u0027s root cause is the improper handling of the query string in the SAML HTTP-Redirect binding response, which fails to strip or validate pre-existing SAML parameters.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat build of Keycloak 26.6.8"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-18217"
        },
        {
          "category": "external",
          "summary": "RHBZ#2508311",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2508311"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-18217",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-18217"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-18217",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-18217"
        }
      ],
      "release_date": "2026-07-28T12:03:23+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-06T10:21:57+00:00",
          "details": "Before applying the update, back up your existing installation,\nincluding all applications, configuration files, databases and\ndatabase settings, and so on.",
          "product_ids": [
            "Red Hat build of Keycloak 26.6.8"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:95761"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat build of Keycloak 26.6.8"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.4,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat build of Keycloak 26.6.8"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "keycloak-services: keycloak-services: SAML HTTP-Redirect binding response preserves query string leading to parameter pollution"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Paul Bottinelli"
          ],
          "organization": "Trail of Bits in collaboration with OpenAI"
        }
      ],
      "cve": "CVE-2026-18569",
      "cwe": {
        "id": "CWE-347",
        "name": "Improper Verification of Cryptographic Signature"
      },
      "discovery_date": "2026-07-31T10:18:53+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2509755"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the backchannel logout endpoint of the keycloak-services component, which is part of the Red Hat Build of Keycloak. This component handles authentication and session management for applications. The issue occurs when an OIDC identity provider is configured to skip signature validation. In this specific setup, the system incorrectly accepts logout requests that have no cryptographic signature. An attacker who knows certain technical details about a user\u0027s session can use this flaw to force that user to be logged out, potentially disrupting their work.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "keycloak-services: keycloak-services: OIDC backchannel logout accepts unsigned forged logout tokens",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "The Red Hat Product Security team has assessed the severity of this vulnerability as Low, given that it requires a non-default insecure configuration and knowledge of specific session identifiers to exploit. Successful exploitation allows an attacker to force-logout targeted brokered users, leading to a limited denial of service for those individuals. The vulnerability\u0027s root cause is the failure to enforce signature validation on backchannel logout tokens when the identity provider\u0027s signature validation setting is disabled.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat build of Keycloak 26.6.8"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-18569"
        },
        {
          "category": "external",
          "summary": "RHBZ#2509755",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2509755"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-18569",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-18569"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-18569",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-18569"
        }
      ],
      "release_date": "2026-07-31T10:18:53+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-06T10:21:57+00:00",
          "details": "Before applying the update, back up your existing installation,\nincluding all applications, configuration files, databases and\ndatabase settings, and so on.",
          "product_ids": [
            "Red Hat build of Keycloak 26.6.8"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:95761"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat build of Keycloak 26.6.8"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat build of Keycloak 26.6.8"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "keycloak-services: keycloak-services: OIDC backchannel logout accepts unsigned forged logout tokens"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Paul Bottinelli of Trail of Bits in collaboration with OpenAI"
          ]
        }
      ],
      "cve": "CVE-2026-19608",
      "cwe": {
        "id": "CWE-285",
        "name": "Improper Authorization"
      },
      "discovery_date": "2026-08-11T20:28:49+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2514530"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the group policy provider of Keycloak authorization services, which is used to manage fine-grained access control to resources. The issue occurs when the system evaluates group-based policies using tokens that only contain group names rather than full paths. If two groups in different parts of the organization share the same name, a user in the unauthorized group can be mistaken for a member of the authorized group. This can allow a user to gain unauthorized access to protected resources they should not be able to reach.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "keycloak-services: keycloak-services: Name-only group claims let same-name groups satisfy path-specific group policies",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "The Red Hat Product Security team has assessed the severity of this vulnerability as Moderate, given that exploitation requires a specific configuration where OIDC group mappers emit name-only claims and a group name collision exists across different paths. Successful exploitation allows an attacker to gain unauthorized access to protected resources by satisfying a group-based policy they are not intended to meet. The vulnerability\u0027s root cause is the group policy provider\u0027s fallback to matching bare group names when full path information is missing from the token claims.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat build of Keycloak 26.6.8"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-19608"
        },
        {
          "category": "external",
          "summary": "RHBZ#2514530",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2514530"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-19608",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-19608"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-19608",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-19608"
        }
      ],
      "release_date": "2026-08-11T20:28:49+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-06T10:21:57+00:00",
          "details": "Before applying the update, back up your existing installation,\nincluding all applications, configuration files, databases and\ndatabase settings, and so on.",
          "product_ids": [
            "Red Hat build of Keycloak 26.6.8"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:95761"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat build of Keycloak 26.6.8"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat build of Keycloak 26.6.8"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "keycloak-services: keycloak-services: Name-only group claims let same-name groups satisfy path-specific group policies"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "LiuBo-keep (aidan)"
          ],
          "summary": "Acknowledged by upstream."
        }
      ],
      "cve": "CVE-2026-19611",
      "cwe": {
        "id": "CWE-173",
        "name": "Improper Handling of Alternate Encoding"
      },
      "discovery_date": "2026-07-24T14:34:50+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2514568"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in WildFly Elytron. Password hashing and verification normalize input with Unicode NFKC, which can collapse fullwidth characters to ASCII equivalents. A remote attacker can more easily guess affected passwords by using an ASCII-only dictionary against accounts whose passwords were intended to include those non-ASCII characters, leading to unauthorized access.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "wildfly-elytron: org.wildfly.security/wildfly-elytron-password-impl: wildfly-elytron: Password keyspace reduction via NFKC fullwidth folding",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This issue has Moderate impact. Successful exploitation depends on accounts using fullwidth or other NFKC-compatibility characters in passwords and on the feasibility of password guessing against the deployed hash algorithm. Red Hat products that ship org.wildfly.security:wildfly-elytron-password-impl may be affected.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat build of Keycloak 26.6.8"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-19611"
        },
        {
          "category": "external",
          "summary": "RHBZ#2514568",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2514568"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-19611",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-19611"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-19611",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-19611"
        }
      ],
      "release_date": "2026-07-24T14:34:50+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-06T10:21:57+00:00",
          "details": "Before applying the update, back up your existing installation,\nincluding all applications, configuration files, databases and\ndatabase settings, and so on.",
          "product_ids": [
            "Red Hat build of Keycloak 26.6.8"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:95761"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat build of Keycloak 26.6.8"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat build of Keycloak 26.6.8"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "wildfly-elytron: org.wildfly.security/wildfly-elytron-password-impl: wildfly-elytron: Password keyspace reduction via NFKC fullwidth folding"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Pedro Igor Silva"
          ],
          "organization": "IBM"
        }
      ],
      "cve": "CVE-2026-19688",
      "cwe": {
        "id": "CWE-287",
        "name": "Improper Authentication"
      },
      "discovery_date": "2026-08-11T20:20:40+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2514534"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Admin REST API of Keycloak, an identity and access management solution. The Admin API fails to verify the intended audience of bearer tokens during authentication. This issue allows an attacker who operates a client within a realm to capture an administrator\u0027s access token and reuse it to perform unauthorized administrative actions, potentially leading to full realm compromise.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "keycloak-services: keycloak-services: Admin API missing audience check",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "The Red Hat Product Security team has assessed the severity of this vulnerability as Moderate, given that exploitation requires an administrator to log into a compromised client and the attacker to capture the resulting token. Successful exploitation allows an attacker to perform unauthorized administrative operations on the Keycloak realm. The vulnerability\u0027s root cause is the failure of the Admin API to enforce audience restrictions on bearer tokens.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat build of Keycloak 26.6.8"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-19688"
        },
        {
          "category": "external",
          "summary": "RHBZ#2514534",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2514534"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-19688",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-19688"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-19688",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-19688"
        }
      ],
      "release_date": "2026-11-05T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-06T10:21:57+00:00",
          "details": "Before applying the update, back up your existing installation,\nincluding all applications, configuration files, databases and\ndatabase settings, and so on.",
          "product_ids": [
            "Red Hat build of Keycloak 26.6.8"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:95761"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat build of Keycloak 26.6.8"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "keycloak-services: keycloak-services: Admin API missing audience check"
    },
    {
      "cve": "CVE-2026-58059",
      "cwe": {
        "id": "CWE-1333",
        "name": "Inefficient Regular Expression Complexity"
      },
      "discovery_date": "2026-08-03T03:02:32.846217+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2510250"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Bouncy Castle for Java. A remote, unauthenticated attacker could exploit a quadratic-time escaping vulnerability when stringifying X.500 distinguished names. This could lead to a Denial of Service (DoS) due to excessive resource consumption.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "org.bouncycastle/bc-java: Bouncy Castle for Java: Denial of Service via quadratic-time escaping of X.500 distinguished names",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "An algorithmic complexity vulnerability was found in Bouncy Castle for Java. The library performs quadratic-time escaping while stringifying X.500 distinguished names. An unauthenticated remote attacker can exploit this by passing a specially crafted X.500 distinguished name\u2014such as within an X.509 certificate during TLS handshakes or PKI parsing operations\u2014forcing high CPU resource consumption. This execution causes processing delays and leads to Denial of Service (DoS) for applications parsing untrusted distinguished names.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat build of Keycloak 26.6.8"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-58059"
        },
        {
          "category": "external",
          "summary": "RHBZ#2510250",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2510250"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-58059",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-58059"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-58059",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-58059"
        },
        {
          "category": "external",
          "summary": "https://github.com/bcgit/bc-java/commit/7bf20eea8c1b71a4d3574b75ba20ccf26ffff36b",
          "url": "https://github.com/bcgit/bc-java/commit/7bf20eea8c1b71a4d3574b75ba20ccf26ffff36b"
        },
        {
          "category": "external",
          "summary": "https://github.com/bcgit/bc-java/wiki/CVE-2026-58059",
          "url": "https://github.com/bcgit/bc-java/wiki/CVE-2026-58059"
        }
      ],
      "release_date": "2026-08-03T02:41:30.973000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-06T10:21:57+00:00",
          "details": "Before applying the update, back up your existing installation,\nincluding all applications, configuration files, databases and\ndatabase settings, and so on.",
          "product_ids": [
            "Red Hat build of Keycloak 26.6.8"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:95761"
        },
        {
          "category": "workaround",
          "details": "Limit the maximum string length of incoming X.500 distinguished names at application or API gateway boundaries, or restrict the acceptance of unauthenticated client certificates containing complex distinguished names.",
          "product_ids": [
            "Red Hat build of Keycloak 26.6.8"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat build of Keycloak 26.6.8"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "org.bouncycastle/bc-java: Bouncy Castle for Java: Denial of Service via quadratic-time escaping of X.500 distinguished names"
    },
    {
      "cve": "CVE-2026-59903",
      "cwe": {
        "id": "CWE-444",
        "name": "Inconsistent Interpretation of HTTP Requests"
      },
      "discovery_date": "2026-08-17T18:11:22.687313+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2517538"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Netty, an asynchronous, event-driven network application framework. The `CorsHandler` component incorrectly replaces application `Vary` headers, such as `Authorization` or `Cookie`, with `Origin`. This allows a caching proxy or Content Delivery Network (CDN) to reuse authenticated responses across different users, leading to the disclosure of sensitive information.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "io.netty/netty: Netty: Information disclosure via CORS Vary header overwrite",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Moderate impact information disclosure flaw in Netty arises from the `CorsHandler` incorrectly overwriting application `Vary` headers with `Origin`. This could allow caching proxies or CDNs to reuse authenticated responses across different users, potentially exposing sensitive data. Exploitation requires the presence of a caching proxy or CDN in front of the affected Netty application.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat build of Keycloak 26.6.8"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-59903"
        },
        {
          "category": "external",
          "summary": "RHBZ#2517538",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2517538"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-59903",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-59903"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-59903",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59903"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/pull/17213",
          "url": "https://github.com/netty/netty/pull/17213"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/pull/17217",
          "url": "https://github.com/netty/netty/pull/17217"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/releases/tag/netty-4.1.137.Final",
          "url": "https://github.com/netty/netty/releases/tag/netty-4.1.137.Final"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/releases/tag/netty-4.2.17.Final",
          "url": "https://github.com/netty/netty/releases/tag/netty-4.2.17.Final"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/security/advisories/GHSA-8c42-7qj2-3j46",
          "url": "https://github.com/netty/netty/security/advisories/GHSA-8c42-7qj2-3j46"
        }
      ],
      "release_date": "2026-08-17T17:56:28.726000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-06T10:21:57+00:00",
          "details": "Before applying the update, back up your existing installation,\nincluding all applications, configuration files, databases and\ndatabase settings, and so on.",
          "product_ids": [
            "Red Hat build of Keycloak 26.6.8"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:95761"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat build of Keycloak 26.6.8"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat build of Keycloak 26.6.8"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "io.netty/netty: Netty: Information disclosure via CORS Vary header overwrite"
    },
    {
      "cve": "CVE-2026-75595",
      "cwe": {
        "id": "CWE-823",
        "name": "Use of Out-of-range Pointer Offset"
      },
      "discovery_date": "2026-08-19T21:20:58.535091+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2519953"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Netty, an asynchronous, event-driven network application framework. An unauthenticated remote attacker can exploit fragmented Transport Layer Security (TLS) ClientHello messages to bypass the Server Name Indication (SNI) routing mechanism. This forces a fallback to a less secure default SslContext, allowing the attacker to bypass mutual TLS authentication requirements and gain unauthorized access to protected resources.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "io.netty/netty-handler: Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important flaw in Netty that allows an unauthenticated remote attacker to bypass mutual TLS authentication. Applications that use Netty and rely solely on SNI-based clientAuth=REQUIRE for access control, without additional application-layer certificate verification, are vulnerable when an attacker exploits fragmented TLS ClientHello messages to force a fallback to a less secure default SslContext. Deployments that enforce clientAuth=REQUIRE uniformly across all SslContexts, or that perform secondary certificate verification at the application layer, are not affected.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat build of Keycloak 26.6.8"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-75595"
        },
        {
          "category": "external",
          "summary": "RHBZ#2519953",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2519953"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-75595",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-75595"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-75595",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-75595"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/commit/1b5abc6443b63726c72cdd285af2feb7ddbb8ff7",
          "url": "https://github.com/netty/netty/commit/1b5abc6443b63726c72cdd285af2feb7ddbb8ff7"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/commit/9e0519239108a69b7e9bbc5e9182ee139a0d7961",
          "url": "https://github.com/netty/netty/commit/9e0519239108a69b7e9bbc5e9182ee139a0d7961"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/pull/17213",
          "url": "https://github.com/netty/netty/pull/17213"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/pull/17217",
          "url": "https://github.com/netty/netty/pull/17217"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/releases/tag/netty-4.1.137.Final",
          "url": "https://github.com/netty/netty/releases/tag/netty-4.1.137.Final"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/releases/tag/netty-4.2.17.Final",
          "url": "https://github.com/netty/netty/releases/tag/netty-4.2.17.Final"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/security/advisories/GHSA-c4c3-7fpv-j4q5",
          "url": "https://github.com/netty/netty/security/advisories/GHSA-c4c3-7fpv-j4q5"
        }
      ],
      "release_date": "2026-08-19T21:00:27.627000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-06T10:21:57+00:00",
          "details": "Before applying the update, back up your existing installation,\nincluding all applications, configuration files, databases and\ndatabase settings, and so on.",
          "product_ids": [
            "Red Hat build of Keycloak 26.6.8"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:95761"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, ensure that application-layer certificate verification is implemented for services utilizing Netty with mutual TLS. This provides an additional layer of authentication beyond the TLS handshake, preventing unauthorized access even if the SNI routing is bypassed and a less restrictive default SslContext is used.",
          "product_ids": [
            "Red Hat build of Keycloak 26.6.8"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat build of Keycloak 26.6.8"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "io.netty/netty-handler: Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext"
    },
    {
      "cve": "CVE-2026-77874",
      "cwe": {
        "id": "CWE-89",
        "name": "Improper Neutralization of Special Elements used in an SQL Command"
      },
      "discovery_date": "2026-08-11T01:30:47.988000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2513748"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Hibernate ORM. This vulnerability allows an authenticated attacker to inject arbitrary SQL commands into the underlying database by manipulating the JSON path argument. The issue arises from improper handling of JSON path segments in the JsonPathHelper.appendInlinedJsonPathIncludingPassingClause() method, specifically when using Oracle, DB2, or HANA database dialects. Successful exploitation can lead to authorization bypass and significant data exfiltration, enabling the attacker to access sensitive information from the database.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "org.hibernate/hibernate-core: Hibernate ORM: SQL Injection via unescaped JSON path segment allows data exfiltration and authorization bypass",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This flaw is rated as Important. An authenticated remote attacker can bypass authorization controls and exfiltrate data from the underlying database by injecting SQL through the JSON path parameter in Hibernate ORM. This is due to improper escaping of the leading JSON path segment in certain database dialects, which is reachable in default configurations of applications using Hibernate ORM\u0027s Criteria API.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat build of Keycloak 26.6.8"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-77874"
        },
        {
          "category": "external",
          "summary": "RHBZ#2513748",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2513748"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-77874",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-77874"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-77874",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-77874"
        }
      ],
      "release_date": "2026-09-17T13:30:48+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-06T10:21:57+00:00",
          "details": "Before applying the update, back up your existing installation,\nincluding all applications, configuration files, databases and\ndatabase settings, and so on.",
          "product_ids": [
            "Red Hat build of Keycloak 26.6.8"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:95761"
        },
        {
          "category": "workaround",
          "details": "To mitigate this vulnerability, applications using Hibernate ORM should avoid passing untrusted user-controlled input directly as JSON path arguments to `json_query`, `json_exists`, or `json_value` functions. If dynamic JSON querying is necessary, strictly validate or whitelist the JSON path input against a predefined pattern (e.g., allowing only alphanumeric characters and dots) before use.",
          "product_ids": [
            "Red Hat build of Keycloak 26.6.8"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 8.6,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat build of Keycloak 26.6.8"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "org.hibernate/hibernate-core: Hibernate ORM: SQL Injection via unescaped JSON path segment allows data exfiltration and authorization bypass"
    },
    {
      "cve": "CVE-2026-82965",
      "cwe": {
        "id": "CWE-400",
        "name": "Uncontrolled Resource Consumption"
      },
      "discovery_date": "2026-08-31T12:26:56+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2526302"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the SAML implementation of Keycloak, an open-source identity and access management solution. The SAML Artifact Resolution and ECP SOAP endpoints do not properly limit the size or complexity of incoming XML requests. An unauthenticated remote attacker can exploit this by sending specially crafted, large XML messages that cause the server to consume excessive memory. This leads to the application running out of memory and crashing, resulting in a denial of service for all users.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "keycloak-services: keycloak-services: Unauthenticated Denial of Service via SAML SOAP endpoint unbounded XML parsing",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "The Red Hat Product Security team has assessed the severity of this vulnerability as Important, given that it can be exploited by an unauthenticated remote attacker. Successful exploitation allows an attacker to cause a complete denial of service by crashing the Keycloak process. The vulnerability\u0027s root cause is the lack of proper size and element count validation for XML payloads processed by the SAML SOAP endpoints.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat build of Keycloak 26.6.8"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-82965"
        },
        {
          "category": "external",
          "summary": "RHBZ#2526302",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2526302"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-82965",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-82965"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-82965",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-82965"
        }
      ],
      "release_date": "2026-11-05T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-06T10:21:57+00:00",
          "details": "Before applying the update, back up your existing installation,\nincluding all applications, configuration files, databases and\ndatabase settings, and so on.",
          "product_ids": [
            "Red Hat build of Keycloak 26.6.8"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:95761"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat build of Keycloak 26.6.8"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat build of Keycloak 26.6.8"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "keycloak-services: keycloak-services: Unauthenticated Denial of Service via SAML SOAP endpoint unbounded XML parsing"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "He Wei\uff08\u30ae\u30ab\u30af\uff09"
          ]
        }
      ],
      "cve": "CVE-2026-82968",
      "cwe": {
        "id": "CWE-639",
        "name": "Authorization Bypass Through User-Controlled Key"
      },
      "discovery_date": "2026-08-27T10:19:11+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2526318"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the first-broker-login flow of the Keycloak identity management service. When a user links a social identity provider account to their local account, the verification proof generated is not strictly bound to the specific upstream identity being verified. This allows an attacker with a different account on the same social provider to intercept the process and link their own account to the victim\u0027s local profile, gaining unauthorized access.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "keycloak-services: keycloak-services: Cross-session email verification proof not bound to upstream identity for social providers",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "The Red Hat Product Security team has assessed the severity of this vulnerability as Moderate, given that exploitation requires specific timing and user interaction during an active account-linking process. Successful exploitation allows an attacker to link their own social identity to a victim\u0027s local account and gain unauthorized access to the victim\u0027s data and permissions. The vulnerability\u0027s root cause is the failure to bind the cross-session verification proof to the specific upstream identity for social providers.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat build of Keycloak 26.6.8"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-82968"
        },
        {
          "category": "external",
          "summary": "RHBZ#2526318",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2526318"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-82968",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-82968"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-82968",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-82968"
        }
      ],
      "release_date": "2026-08-27T10:19:11+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-06T10:21:57+00:00",
          "details": "Before applying the update, back up your existing installation,\nincluding all applications, configuration files, databases and\ndatabase settings, and so on.",
          "product_ids": [
            "Red Hat build of Keycloak 26.6.8"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:95761"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat build of Keycloak 26.6.8"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat build of Keycloak 26.6.8"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "keycloak-services: keycloak-services: Cross-session email verification proof not bound to upstream identity for social providers"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Sunil Tripathy"
          ]
        }
      ],
      "cve": "CVE-2026-88770",
      "cwe": {
        "id": "CWE-307",
        "name": "Improper Restriction of Excessive Authentication Attempts"
      },
      "discovery_date": "2026-09-09T17:32:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2531302"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Device Authorization Grant flow of Keycloak, an identity and access management solution. The issue occurs because the token redemption process fails to check if a user account is currently locked due to brute-force protection. If an attacker has an active session for a locked account, they can complete the device login process and receive new security tokens. This allows the attacker to maintain access to the account even when it should be temporarily disabled to prevent unauthorized entry.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "keycloak-services: keycloak-services: Device Authorization Grant issues tokens to brute-force-locked accounts",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "The Red Hat Product Security team has assessed the severity of this vulnerability as Moderate, given that exploitation requires the attacker to hold a valid SSO browser session for the target account established prior to the lockout. Successful exploitation allows an attacker to bypass brute-force protection policies and obtain valid tokens for a locked account. The vulnerability\u0027s root cause is the missing brute-force status check in the Device Authorization Grant token redemption code path.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat build of Keycloak 26.6.8"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-88770"
        },
        {
          "category": "external",
          "summary": "RHBZ#2531302",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2531302"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-88770",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-88770"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-88770",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-88770"
        }
      ],
      "release_date": "2026-09-09T17:32:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-06T10:21:57+00:00",
          "details": "Before applying the update, back up your existing installation,\nincluding all applications, configuration files, databases and\ndatabase settings, and so on.",
          "product_ids": [
            "Red Hat build of Keycloak 26.6.8"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:95761"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat build of Keycloak 26.6.8"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat build of Keycloak 26.6.8"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "keycloak-services: keycloak-services: Device Authorization Grant issues tokens to brute-force-locked accounts"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Animesh Roy"
          ],
          "organization": "Anir0y"
        }
      ],
      "cve": "CVE-2026-89298",
      "cwe": {
        "id": "CWE-200",
        "name": "Exposure of Sensitive Information to an Unauthorized Actor"
      },
      "discovery_date": "2026-09-10T19:03:32+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2531871"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Dynamic Client Registration service of Keycloak, an open-source identity and access management solution. The issue occurs when a user with the view-clients role accesses the client registration endpoint to retrieve client details. Due to a failure to mask sensitive information, the service returns the client\u0027s confidential secret in cleartext. This could allow a read-only administrator to obtain full access to the affected client\u0027s account and potentially escalate their privileges within the realm.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "keycloak-services: keycloak-services: Confidential client secret disclosed to view-clients role via Client Registration GET",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "The Red Hat Product Security team has assessed the severity of this vulnerability as Moderate, given that exploitation requires the attacker to already possess the view-clients administrative role. Successful exploitation allows an attacker to retrieve cleartext client secrets for confidential clients, which can be used to impersonate the client and potentially escalate privileges. The vulnerability\u0027s root cause is a failure to apply secret masking to the Dynamic Client Registration GET endpoint.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat build of Keycloak 26.6.8"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-89298"
        },
        {
          "category": "external",
          "summary": "RHBZ#2531871",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2531871"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-89298",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-89298"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-89298",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-89298"
        }
      ],
      "release_date": "2026-09-10T19:03:32+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-06T10:21:57+00:00",
          "details": "Before applying the update, back up your existing installation,\nincluding all applications, configuration files, databases and\ndatabase settings, and so on.",
          "product_ids": [
            "Red Hat build of Keycloak 26.6.8"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:95761"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat build of Keycloak 26.6.8"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat build of Keycloak 26.6.8"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "keycloak-services: keycloak-services: Confidential client secret disclosed to view-clients role via Client Registration GET"
    },
    {
      "cve": "CVE-2026-91776",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-09-23T02:30:54.923305+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2539083"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in jackson-databind. A remote attacker can exploit this vulnerability by repeatedly supplying distinct, unrecognized type identifiers to an application configured with name-based polymorphism and a fallback deserializer. This action causes the TypeDeserializerBase component to retain every unknown type ID in an unbounded cache, leading to monotonic memory consumption. Over time, this uncontrolled resource consumption can result in a Denial of Service (DoS) due to memory exhaustion.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "jackson-databind: com.fasterxml.jackson/jackson-core: jackson-databind: Denial of Service via unbounded cache growth in TypeDeserializerBase",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat rates this vulnerability as Important because an unauthenticated remote attacker can exhaust Java Virtual Machine memory, leading to a complete denial of service for the hosting service without requiring elevated permissions. Exploitation depends on applications accepting untrusted input and exposing polymorphic deserialization configured with a default fallback implementation across long-lived mapper instances. In typical Red Hat deployments, polymorphic handling with fallback deserializers is not the default configuration, substantially narrowing the exposure to custom or specifically configured workloads.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat build of Keycloak 26.6.8"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-91776"
        },
        {
          "category": "external",
          "summary": "RHBZ#2539083",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2539083"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-91776",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-91776"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-91776",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91776"
        },
        {
          "category": "external",
          "summary": "https://github.com/FasterXML/jackson-databind/issues/6203",
          "url": "https://github.com/FasterXML/jackson-databind/issues/6203"
        },
        {
          "category": "external",
          "summary": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54",
          "url": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54"
        }
      ],
      "release_date": "2026-09-23T02:17:50.480000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-06T10:21:57+00:00",
          "details": "Before applying the update, back up your existing installation,\nincluding all applications, configuration files, databases and\ndatabase settings, and so on.",
          "product_ids": [
            "Red Hat build of Keycloak 26.6.8"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:95761"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat build of Keycloak 26.6.8"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "jackson-databind: com.fasterxml.jackson/jackson-core: jackson-databind: Denial of Service via unbounded cache growth in TypeDeserializerBase"
    },
    {
      "cve": "CVE-2026-91777",
      "cwe": {
        "id": "CWE-606",
        "name": "Unchecked Input for Loop Condition"
      },
      "discovery_date": "2026-09-23T02:31:01.024251+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2539085"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in FasterXML jackson-databind. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by providing specially crafted JSON input to an application that deserializes it into an identity-enabled collection or map. The flaw occurs due to inefficient processing of forward-references, where the system performs a quadratic amount of work for linearly growing input, leading to excessive CPU consumption.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "com.fasterxml.jackson.core/jackson-databind: tools.jackson.core:jackson-databind: Jackson-databind: Denial of Service via quadratic forward-reference completion",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "A flaw was found in jackson-databind. Forward-reference completion for `@JsonIdentityInfo` object IDs in `CollectionDeserializer.CollectionReferringAccumulator.resolveForwardReference()` and the equivalent implementation in `MapDeserializer` performs a linear scan of the pending-reference accumulator for every resolved ID.\n\nWhen a document creates unresolved object-ID references in an identity-enabled collection or map and then defines those IDs in reverse order, completion performs quadratic CPU work, allowing an attacker to cause a Denial of Service by sending specially crafted JSON input.\n\nExploitation requires an application that deserializes attacker-influenced JSON into an `@JsonIdentityInfo`-annotated collection or map.\n\nThe fix replaces the repeated linear lookup with a keyed pending-reference structure.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat build of Keycloak 26.6.8"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-91777"
        },
        {
          "category": "external",
          "summary": "RHBZ#2539085",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2539085"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-91777",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-91777"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-91777",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91777"
        },
        {
          "category": "external",
          "summary": "https://github.com/FasterXML/jackson-databind/issues/6204",
          "url": "https://github.com/FasterXML/jackson-databind/issues/6204"
        },
        {
          "category": "external",
          "summary": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24",
          "url": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24"
        }
      ],
      "release_date": "2026-09-23T02:21:48.323000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-06T10:21:57+00:00",
          "details": "Before applying the update, back up your existing installation,\nincluding all applications, configuration files, databases and\ndatabase settings, and so on.",
          "product_ids": [
            "Red Hat build of Keycloak 26.6.8"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:95761"
        },
        {
          "category": "workaround",
          "details": "Upgrade to a patched version. Refer to the advisory for the patched versions: https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24.\n\nExample `pom.xml`:\n```\n\u003cdependency\u003e\n    \u003cgroupId\u003ecom.fasterxml.jackson.core\u003c/groupId\u003e\n    \u003cartifactId\u003ejackson-databind\u003c/artifactId\u003e\n    \u003cversion\u003e2.18.11\u003c/version\u003e\n\u003c/dependency\u003e\n```\n\nVerify: `mvn dependency:tree -Dincludes=com.fasterxml.jackson.core:jackson-databind`\n\nIf you cannot upgrade directly, apply defense-in-depth mitigations:\n- Restrict JSON request size\n- Audit and remove unnecessary @JsonIdentityInfo",
          "product_ids": [
            "Red Hat build of Keycloak 26.6.8"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat build of Keycloak 26.6.8"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "com.fasterxml.jackson.core/jackson-databind: tools.jackson.core:jackson-databind: Jackson-databind: Denial of Service via quadratic forward-reference completion"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "He Wei\uff08\u30ae\u30ab\u30af\uff09"
          ]
        }
      ],
      "cve": "CVE-2026-92358",
      "cwe": {
        "id": "CWE-613",
        "name": "DEPRECATED: Insufficient Session Expiration"
      },
      "discovery_date": "2026-09-16T02:26:11+00:00",
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the first broker login flow of Keycloak. When a user confirms an account-linking request from a different browser, a temporary proof is created to validate the link. However, this proof is not properly cleared after the link is established or when the user later manually removes the link. An attacker who controls the external identity can exploit this leftover proof to silently re-establish the link and gain unauthorized access to the victims account without any further confirmation.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "keycloak-services: keycloak-services: Residual cross-browser account-link proof allows silent re-linking",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "The Red Hat Product Security team has assessed the severity of this vulnerability as Moderate, given that exploitation requires a specific sequence of user actions and must be performed within a short time window before the server-side proof expires. Successful exploitation allows an attacker to silently re-link an external identity to a victims account and gain unauthorized access. The vulnerabilitys root cause is the failure to consume or revoke the cross-session account-link proof upon successful linking or manual unlinking.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat build of Keycloak 26.6.8"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-92358"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-92358",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-92358"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-92358",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-92358"
        }
      ],
      "release_date": "2026-09-16T02:26:11+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-06T10:21:57+00:00",
          "details": "Before applying the update, back up your existing installation,\nincluding all applications, configuration files, databases and\ndatabase settings, and so on.",
          "product_ids": [
            "Red Hat build of Keycloak 26.6.8"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:95761"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat build of Keycloak 26.6.8"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat build of Keycloak 26.6.8"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "keycloak-services: keycloak-services: Residual cross-browser account-link proof allows silent re-linking"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "yd1ng"
          ]
        }
      ],
      "cve": "CVE-2026-92855",
      "cwe": {
        "id": "CWE-287",
        "name": "Improper Authentication"
      },
      "discovery_date": "2026-09-16T13:45:07+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2535814"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the SAML identity broker component of Keycloak, which is used to delegate authentication to external identity providers. The issue occurs because the broker fails to verify that a user actually possesses the private key associated with a holder-of-key assertion. An attacker who intercepts a victim signed assertion can replay it to gain unauthorized access and impersonate the victim without needing their private key.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "keycloak-services: keycloak-services: SAML broker accepts holder-of-key assertions without proof of key possession",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "The Red Hat Product Security team has assessed the severity of this vulnerability as Important, given that exploitation requires the attacker to obtain a valid signed SAML assertion issued for a victim. Successful exploitation allows an attacker to bypass authentication and impersonate users within the Keycloak environment. The vulnerability\u0027s root cause is the failure of the SAML broker to enforce proof of key possession when processing holder-of-key assertions.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat build of Keycloak 26.6.8"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-92855"
        },
        {
          "category": "external",
          "summary": "RHBZ#2535814",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2535814"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-92855",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-92855"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-92855",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-92855"
        }
      ],
      "release_date": "2026-11-05T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-06T10:21:57+00:00",
          "details": "Before applying the update, back up your existing installation,\nincluding all applications, configuration files, databases and\ndatabase settings, and so on.",
          "product_ids": [
            "Red Hat build of Keycloak 26.6.8"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:95761"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat build of Keycloak 26.6.8"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat build of Keycloak 26.6.8"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "keycloak-services: keycloak-services: SAML broker accepts holder-of-key assertions without proof of key possession"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "yd1ng"
          ]
        }
      ],
      "cve": "CVE-2026-92856",
      "cwe": {
        "id": "CWE-862",
        "name": "Missing Authorization"
      },
      "discovery_date": "2026-09-16T13:45:01+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2535815"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the SAML brokering component of Keycloak, an identity and access management solution. The issue occurs when Keycloak acts as an intermediary between an upstream identity provider and downstream services. Keycloak fails to respect specific security instructions called ProxyRestrictions in the login messages it receives. This allows a user to log into downstream services even when the original identity provider explicitly forbade further sharing of the login session. As a result, users can bypass security boundaries intended to limit where their identity can be used.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "keycloak-services: keycloak-services: SAML broker ignores ProxyRestriction delegation constraints",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "The Red Hat Product Security team has assessed the severity of this vulnerability as Moderate, given that exploitation requires a specific SAML brokering configuration and the presence of ProxyRestriction conditions from a trusted upstream provider. Successful exploitation allows an attacker to bypass identity delegation boundaries and establish unauthorized sessions in downstream service providers. The vulnerability\u0027s root cause is the failure of the Keycloak SAML validator to enforce ProxyRestriction constraints during the brokering flow.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat build of Keycloak 26.6.8"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-92856"
        },
        {
          "category": "external",
          "summary": "RHBZ#2535815",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2535815"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-92856",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-92856"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-92856",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-92856"
        }
      ],
      "release_date": "2026-11-05T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-06T10:21:57+00:00",
          "details": "Before applying the update, back up your existing installation,\nincluding all applications, configuration files, databases and\ndatabase settings, and so on.",
          "product_ids": [
            "Red Hat build of Keycloak 26.6.8"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:95761"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat build of Keycloak 26.6.8"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat build of Keycloak 26.6.8"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "keycloak-services: keycloak-services: SAML broker ignores ProxyRestriction delegation constraints"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Eurico Nicacio"
          ],
          "organization": "independent"
        }
      ],
      "cve": "CVE-2026-92857",
      "cwe": {
        "id": "CWE-20",
        "name": "Improper Input Validation"
      },
      "discovery_date": "2026-09-16T16:34:59+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2535817"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Keycloak provides a Dynamic Client Registration feature that allows users with specific tokens to register their own applications. A flaw in how Keycloak validates these registration requests allows an attacker to create a malicious application that forges identity information. By mapping their own user profile details to protected fields like the user ID (sub) or intended audience (aud), an attacker can generate signed security tokens that make them appear to be a different user. This could allow an attacker to impersonate other users or gain unauthorized access to services that rely on these tokens for identity verification.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "keycloak-services: keycloak-services: DCR protocol mapper config not validated, allowing IAT holders to forge sub and aud claims in signed tokens",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "The Red Hat Product Security team has assessed the severity of this vulnerability as Important, given that exploitation requires the attacker to possess a valid Initial Access Token and a realm account. Successful exploitation allows an attacker to forge identity claims in signed tokens, leading to user impersonation across access tokens, ID tokens, and UserInfo responses. The vulnerability\u0027s root cause is a lack of validation for the claim.name field in protocol mapper configurations during Dynamic Client Registration.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat build of Keycloak 26.6.8"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-92857"
        },
        {
          "category": "external",
          "summary": "RHBZ#2535817",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2535817"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-92857",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-92857"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-92857",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-92857"
        }
      ],
      "release_date": "2026-11-05T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-06T10:21:57+00:00",
          "details": "Before applying the update, back up your existing installation,\nincluding all applications, configuration files, databases and\ndatabase settings, and so on.",
          "product_ids": [
            "Red Hat build of Keycloak 26.6.8"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:95761"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat build of Keycloak 26.6.8"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat build of Keycloak 26.6.8"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "keycloak-services: keycloak-services: DCR protocol mapper config not validated, allowing IAT holders to forge sub and aud claims in signed tokens"
    },
    {
      "cve": "CVE-2026-93488",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-09-10T00:39:48+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2536887"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Netty. SpdySessionHandler accepts an unlimited number of concurrent remote-initiated streams because localConcurrentStreams defaults to Integer.MAX_VALUE and the handler provides no API to change it. A remote peer can open a SPDY connection and send a large number of SYN_STREAM frames with FLAG_FIN=0, causing unbounded heap and direct memory allocation that can lead to JVM OutOfMemoryError and a denial of service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "io.netty/netty-codec-http: Netty: Denial of Service via unbounded concurrent SPDY streams",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important denial of service flaw in Netty\u0027s SpdySessionHandler that could allow a remote attacker to exhaust system resources by sending a large number of SPDY SYN_STREAM frames. This can lead to an OutOfMemoryError and crash the affected service, impacting availability. The default configuration allows for an unlimited number of concurrent streams, making services using Netty with SPDY vulnerable to this resource exhaustion attack.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat build of Keycloak 26.6.8"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-93488"
        },
        {
          "category": "external",
          "summary": "RHBZ#2536887",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2536887"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-93488",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-93488"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-93488",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-93488"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/releases/tag/netty-4.1.138.Final",
          "url": "https://github.com/netty/netty/releases/tag/netty-4.1.138.Final"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/releases/tag/netty-4.2.18.Final",
          "url": "https://github.com/netty/netty/releases/tag/netty-4.2.18.Final"
        }
      ],
      "release_date": "2026-09-10T00:39:48+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-06T10:21:57+00:00",
          "details": "Before applying the update, back up your existing installation,\nincluding all applications, configuration files, databases and\ndatabase settings, and so on.",
          "product_ids": [
            "Red Hat build of Keycloak 26.6.8"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:95761"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat build of Keycloak 26.6.8"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat build of Keycloak 26.6.8"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "io.netty/netty-codec-http: Netty: Denial of Service via unbounded concurrent SPDY streams"
    },
    {
      "cve": "CVE-2026-93491",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-09-10T00:40:47+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2536891"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Netty\u0027s HttpServerCodec. A remote, unauthenticated attacker can exploit this vulnerability by pipelining HTTP/1.1 requests on a single connection and withholding reads. This action causes the methodOverflowQueue to grow without limit, leading to unbounded heap memory consumption and a denial of service due to memory exhaustion.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "io.netty/netty-codec-http: Netty: Denial of Service via unbounded HttpServerCodec HTTP/1.1 pipeline queue",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important denial of service vulnerability in Netty\u0027s HttpServerCodec component. A remote, unauthenticated attacker can exploit this flaw by sending a series of pipelined HTTP/1.1 requests without reading responses, leading to unbounded memory growth and potential service unavailability in applications utilizing affected Netty versions. The issue stems from an unbounded queue used to track pipelined requests, which can be exhausted by a malicious client.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat build of Keycloak 26.6.8"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-93491"
        },
        {
          "category": "external",
          "summary": "RHBZ#2536891",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2536891"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-93491",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-93491"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-93491",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-93491"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/releases/tag/netty-4.1.138.Final",
          "url": "https://github.com/netty/netty/releases/tag/netty-4.1.138.Final"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/releases/tag/netty-4.2.18.Final",
          "url": "https://github.com/netty/netty/releases/tag/netty-4.2.18.Final"
        }
      ],
      "release_date": "2026-09-10T00:40:47+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-06T10:21:57+00:00",
          "details": "Before applying the update, back up your existing installation,\nincluding all applications, configuration files, databases and\ndatabase settings, and so on.",
          "product_ids": [
            "Red Hat build of Keycloak 26.6.8"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:95761"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat build of Keycloak 26.6.8"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat build of Keycloak 26.6.8"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "io.netty/netty-codec-http: Netty: Denial of Service via unbounded HttpServerCodec HTTP/1.1 pipeline queue"
    },
    {
      "cve": "CVE-2026-93492",
      "cwe": {
        "id": "CWE-1035",
        "name": "CWE-1035"
      },
      "discovery_date": "2026-09-10T00:41:18+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2536895"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Netty\u0027s HTTP/2 HpackEncoder. A remote attacker can exploit this by sending HTTP/2 SETTINGS frames with a very large MAX_HEADER_TABLE_SIZE. This causes the HpackEncoder to store an excessive number of unique headers, leading to increased CPU usage and memory consumption, ultimately resulting in a Denial of Service (DoS).",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "io.netty/netty-codec-http2: Netty: HTTP/2 HpackEncoder DoS with large table size",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Moderate-impact flaw in Netty\u0027s HTTP/2 HpackEncoder allows a remote attacker to cause a Denial of Service. By sending specially crafted HTTP/2 SETTINGS frames with an oversized header table, an attacker can force the server to consume excessive CPU and memory resources, degrading service availability. This vulnerability affects applications utilizing Netty for HTTP/2 communication.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat build of Keycloak 26.6.8"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-93492"
        },
        {
          "category": "external",
          "summary": "RHBZ#2536895",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2536895"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-93492",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-93492"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-93492",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-93492"
        }
      ],
      "release_date": "2026-09-10T00:41:18+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-06T10:21:57+00:00",
          "details": "Before applying the update, back up your existing installation,\nincluding all applications, configuration files, databases and\ndatabase settings, and so on.",
          "product_ids": [
            "Red Hat build of Keycloak 26.6.8"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:95761"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat build of Keycloak 26.6.8"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat build of Keycloak 26.6.8"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "io.netty/netty-codec-http2: Netty: HTTP/2 HpackEncoder DoS with large table size"
    },
    {
      "cve": "CVE-2026-93558",
      "cwe": {
        "id": "CWE-1035",
        "name": "CWE-1035"
      },
      "discovery_date": "2026-09-10T00:42:37+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2536932"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Netty\u0027s WebSocketServerExtensionHandler. A remote, unauthenticated attacker can exploit this vulnerability by using HTTP/1.1 pipelining to send requests faster than the application can respond. This leads to an unbounded growth of a per-connection queue, consuming excessive memory. Eventually, this can cause the Java Virtual Machine (JVM) to exhaust its heap, resulting in a Denial of Service (DoS) for the affected server.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "io.netty/netty-codec-http: Netty: Unbounded Per-Connection Queue Growth in WebSocketServerExtensionHandler Leads to Denial of Service",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important denial of service vulnerability in Netty\u0027s `WebSocketServerExtensionHandler`. A remote, unauthenticated attacker can exploit unbounded queue growth by sending pipelined HTTP/1.1 requests to a server supporting WebSocket compression. This can lead to JVM heap exhaustion and a denial of service, as memory is not reclaimed until the connection closes.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat build of Keycloak 26.6.8"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-93558"
        },
        {
          "category": "external",
          "summary": "RHBZ#2536932",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2536932"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-93558",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-93558"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-93558",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-93558"
        }
      ],
      "release_date": "2026-09-10T00:42:37+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-06T10:21:57+00:00",
          "details": "Before applying the update, back up your existing installation,\nincluding all applications, configuration files, databases and\ndatabase settings, and so on.",
          "product_ids": [
            "Red Hat build of Keycloak 26.6.8"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:95761"
        },
        {
          "category": "workaround",
          "details": "See https://github.com/netty/netty/security/advisories/GHSA-2g37-3h88-55hc for fixed versions and remediation guidance.",
          "product_ids": [
            "Red Hat build of Keycloak 26.6.8"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat build of Keycloak 26.6.8"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "io.netty/netty-codec-http: Netty: Unbounded Per-Connection Queue Growth in WebSocketServerExtensionHandler Leads to Denial of Service"
    },
    {
      "cve": "CVE-2026-93562",
      "cwe": {
        "id": "CWE-1035",
        "name": "CWE-1035"
      },
      "discovery_date": "2026-09-10T00:45:54+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2536951"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Netty\u0027s HTTP/1 decoder. Incomplete validation of malformed Transfer-Encoding headers allows a remote attacker to perform HTTP request smuggling. By sending specially crafted HTTP requests, an attacker can inject arbitrary HTTP requests, potentially bypassing security controls or accessing unauthorized resources.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "io.netty/netty-codec-http: Netty: Incomplete validation of malformed Transfer-Encoding allows HTTP request smuggling",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Moderate flaw in Netty\u0027s HTTP/1 decoder allows HTTP request smuggling by incorrectly validating `Transfer-Encoding` headers. This can enable an attacker to inject arbitrary HTTP requests, primarily impacting Red Hat products deployed in environments with parser-differential proxies or load balancers, such as Red Hat AMQ, JBoss Fuse, Enterprise Application Platform, and Red Hat Build of Quarkus. The vulnerability arises from an incomplete fix, making it crucial to ensure consistent HTTP parsing across all network components.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat build of Keycloak 26.6.8"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-93562"
        },
        {
          "category": "external",
          "summary": "RHBZ#2536951",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2536951"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-93562",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-93562"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-93562",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-93562"
        }
      ],
      "release_date": "2026-09-10T00:45:54+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-06T10:21:57+00:00",
          "details": "Before applying the update, back up your existing installation,\nincluding all applications, configuration files, databases and\ndatabase settings, and so on.",
          "product_ids": [
            "Red Hat build of Keycloak 26.6.8"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:95761"
        },
        {
          "category": "workaround",
          "details": "See https://github.com/netty/netty/security/advisories/GHSA-hcvj-94mj-jp5c for fixed versions and remediation guidance.",
          "product_ids": [
            "Red Hat build of Keycloak 26.6.8"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat build of Keycloak 26.6.8"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "io.netty/netty-codec-http: Netty: Incomplete validation of malformed Transfer-Encoding allows HTTP request smuggling"
    },
    {
      "cve": "CVE-2026-93564",
      "cwe": {
        "id": "CWE-1035",
        "name": "CWE-1035"
      },
      "discovery_date": "2026-09-10T00:46:51+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2536953"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Netty. A reference-count leak in the HAProxy PROXY-v2 message decoder allows a remote, unauthenticated attacker to send specially crafted PROXY-protocol v2 headers. This can lead to memory exhaustion, resulting in a Denial of Service (DoS) for the affected system.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "io.netty/netty-codec-haproxy: Netty: HAProxy PROXY-v2 nested-TLV grandchild ByteBuf reference-count leak (incomplete fix of PR #16881)",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated as Important. It allows a remote, unauthenticated attacker to cause a denial of service by sending specially crafted PROXY-protocol v2 headers to a service utilizing the `netty-codec-haproxy` component. Repeated malformed requests can lead to memory exhaustion due to a reference-count leak in the `HAProxyMessageDecoder`, impacting the availability of affected Red Hat products.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat build of Keycloak 26.6.8"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-93564"
        },
        {
          "category": "external",
          "summary": "RHBZ#2536953",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2536953"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-93564",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-93564"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-93564",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-93564"
        }
      ],
      "release_date": "2026-09-10T00:46:51+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-06T10:21:57+00:00",
          "details": "Before applying the update, back up your existing installation,\nincluding all applications, configuration files, databases and\ndatabase settings, and so on.",
          "product_ids": [
            "Red Hat build of Keycloak 26.6.8"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:95761"
        },
        {
          "category": "workaround",
          "details": "See https://github.com/netty/netty/security/advisories/GHSA-j58c-g352-8h4p for fixed versions and remediation guidance.",
          "product_ids": [
            "Red Hat build of Keycloak 26.6.8"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat build of Keycloak 26.6.8"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "io.netty/netty-codec-haproxy: Netty: HAProxy PROXY-v2 nested-TLV grandchild ByteBuf reference-count leak (incomplete fix of PR #16881)"
    },
    {
      "cve": "CVE-2026-93565",
      "cwe": {
        "id": "CWE-1035",
        "name": "CWE-1035"
      },
      "discovery_date": "2026-09-10T00:47:19+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2536952"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Netty RtspDecoder. The `RtspMethods.valueOf()` function incorrectly strips trailing control bytes from method tokens in Real-Time Streaming Protocol (RTSP) requests. A remote attacker can exploit this by sending a specially crafted RTSP request, leading to method-token smuggling. This vulnerability allows an attacker to bypass method-based access controls and can also be used to launder malicious requests through Netty-based RTSP proxies, making them appear legitimate to backend systems.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "io.netty/netty-codec-http: Netty RtspDecoder Method-Token Smuggling via Trailing Control Byte",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important flaw affecting Netty-based RTSP servers and proxies. The `RtspDecoder` component incorrectly strips trailing control bytes from RTSP method tokens, allowing an attacker to bypass method-based access controls. This can lead to unauthorized actions or proxy laundering, where a malformed request is normalized and forwarded as legitimate.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat build of Keycloak 26.6.8"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-93565"
        },
        {
          "category": "external",
          "summary": "RHBZ#2536952",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2536952"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-93565",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-93565"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-93565",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-93565"
        }
      ],
      "release_date": "2026-09-10T00:47:19+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-06T10:21:57+00:00",
          "details": "Before applying the update, back up your existing installation,\nincluding all applications, configuration files, databases and\ndatabase settings, and so on.",
          "product_ids": [
            "Red Hat build of Keycloak 26.6.8"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:95761"
        },
        {
          "category": "workaround",
          "details": "See https://github.com/netty/netty/security/advisories/GHSA-h75q-xqrh-59rf for fixed versions and remediation guidance.",
          "product_ids": [
            "Red Hat build of Keycloak 26.6.8"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat build of Keycloak 26.6.8"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "io.netty/netty-codec-http: Netty RtspDecoder Method-Token Smuggling via Trailing Control Byte"
    },
    {
      "cve": "CVE-2026-93566",
      "cwe": {
        "id": "CWE-1035",
        "name": "CWE-1035"
      },
      "discovery_date": "2026-09-10T00:47:37+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2536954"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Netty. A remote attacker could exploit this by sending a specially crafted HTTP request that includes control characters within the chunk-size line. This bypasses the intended strict validation, allowing the attacker to inject arbitrary HTTP requests. This vulnerability can lead to HTTP request smuggling, potentially resulting in information disclosure or other unauthorized actions.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "io.netty/netty-codec-http: Netty: HTTP Request Smuggling due to control characters in the chunk-size line",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Moderate flaw in Netty\u0027s HTTP codec allows HTTP request smuggling. The vulnerability stems from improper validation of chunk size lines, enabling an attacker to inject arbitrary HTTP requests. This could lead to cache poisoning or bypassing security controls in Red Hat products that use affected Netty components and process untrusted HTTP traffic.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat build of Keycloak 26.6.8"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-93566"
        },
        {
          "category": "external",
          "summary": "RHBZ#2536954",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2536954"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-93566",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-93566"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-93566",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-93566"
        }
      ],
      "release_date": "2026-09-10T00:47:37+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-06T10:21:57+00:00",
          "details": "Before applying the update, back up your existing installation,\nincluding all applications, configuration files, databases and\ndatabase settings, and so on.",
          "product_ids": [
            "Red Hat build of Keycloak 26.6.8"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:95761"
        },
        {
          "category": "workaround",
          "details": "See https://github.com/netty/netty/security/advisories/GHSA-rq4j-fc47-9698 for fixed versions and remediation guidance.",
          "product_ids": [
            "Red Hat build of Keycloak 26.6.8"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat build of Keycloak 26.6.8"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "io.netty/netty-codec-http: Netty: HTTP Request Smuggling due to control characters in the chunk-size line"
    },
    {
      "cve": "CVE-2026-93567",
      "cwe": {
        "id": "CWE-20",
        "name": "Improper Input Validation"
      },
      "discovery_date": "2026-09-10T00:48:08+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2536955"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Netty\u0027s HTTP/2 codec. When converting HTTP/1 CONNECT requests to HTTP/2, the component incorrectly uses the Host header instead of the CONNECT authority-form request-target for the tunnel authority. A remote attacker can exploit this by supplying a different Host header, leading to a malformed HTTP/2 CONNECT request. This can bypass security controls such as tunnel allow-lists or egress policies, resulting in integrity loss.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "io.netty/netty-codec-http2: HTTP/1 authority-form CONNECT is translated to malformed HTTP/2 CONNECT with Host-controlled :authority",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Important: This flaw in Netty\u0027s HTTP/1-to-HTTP/2 conversion can lead to an integrity loss in Red Hat products configured as HTTP/1-to-HTTP/2 proxies or gateways. A remote attacker can manipulate the Host header in an HTTP/1 CONNECT request, causing the HTTP/2 CONNECT request to use an attacker-controlled authority. This bypasses security controls such as tunnel allow-lists and egress policies, allowing connections to unintended upstream targets.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat build of Keycloak 26.6.8"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-93567"
        },
        {
          "category": "external",
          "summary": "RHBZ#2536955",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2536955"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-93567",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-93567"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-93567",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-93567"
        }
      ],
      "release_date": "2026-09-10T00:48:08+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-06T10:21:57+00:00",
          "details": "Before applying the update, back up your existing installation,\nincluding all applications, configuration files, databases and\ndatabase settings, and so on.",
          "product_ids": [
            "Red Hat build of Keycloak 26.6.8"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:95761"
        },
        {
          "category": "workaround",
          "details": "See https://github.com/netty/netty/security/advisories/GHSA-45h4-vhwh-fmhg for fixed versions and remediation guidance.",
          "product_ids": [
            "Red Hat build of Keycloak 26.6.8"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat build of Keycloak 26.6.8"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "io.netty/netty-codec-http2: HTTP/1 authority-form CONNECT is translated to malformed HTTP/2 CONNECT with Host-controlled :authority"
    },
    {
      "cve": "CVE-2026-93568",
      "cwe": {
        "id": "CWE-20",
        "name": "Improper Input Validation"
      },
      "discovery_date": "2026-09-10T00:50:42+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2536961"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Netty. A remote attacker could exploit this vulnerability by sending specially crafted HTTP/2 or HTTP/3 Extended CONNECT requests. Netty\u0027s HTTP-object conversion path incorrectly processes these requests as regular HTTP/1.1 CONNECT requests, leading to a loss of critical protocol and path information. This misinterpretation can allow attackers to bypass security policies, such as routing or authorization logic, in applications that rely on Netty for HTTP/2 or HTTP/3 communication, resulting in integrity loss.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "io.netty/netty-codec-http2: io.netty/netty-codec-http3: Netty: HTTP/2 and HTTP/3 Extended CONNECT requests are downgraded as regular CONNECT requests",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important flaw where Netty\u0027s HTTP/2 and HTTP/3 HTTP-object conversion paths incorrectly downgrade Extended CONNECT requests to standard HTTP/1.1 CONNECT requests. This can lead to authorization bypasses in Red Hat products acting as gateways, proxies, or application servers that utilize Netty\u0027s HTTP-object adapters, as critical protocol and path information is lost, preventing proper policy enforcement.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat build of Keycloak 26.6.8"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-93568"
        },
        {
          "category": "external",
          "summary": "RHBZ#2536961",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2536961"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-93568",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-93568"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-93568",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-93568"
        }
      ],
      "release_date": "2026-09-10T00:50:42+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-06T10:21:57+00:00",
          "details": "Before applying the update, back up your existing installation,\nincluding all applications, configuration files, databases and\ndatabase settings, and so on.",
          "product_ids": [
            "Red Hat build of Keycloak 26.6.8"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:95761"
        },
        {
          "category": "workaround",
          "details": "See https://github.com/netty/netty/security/advisories/GHSA-w6j8-x45j-w75f for fixed versions and remediation guidance.",
          "product_ids": [
            "Red Hat build of Keycloak 26.6.8"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat build of Keycloak 26.6.8"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "io.netty/netty-codec-http2: io.netty/netty-codec-http3: Netty: HTTP/2 and HTTP/3 Extended CONNECT requests are downgraded as regular CONNECT requests"
    },
    {
      "cve": "CVE-2026-93569",
      "cwe": {
        "id": "CWE-444",
        "name": "Inconsistent Interpretation of HTTP Requests"
      },
      "discovery_date": "2026-09-10T00:51:06+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2536962"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Netty. A remote unauthenticated attacker can exploit a vulnerability in Netty\u0027s HTTP/1 to HTTP/2 conversion process. When an HTTP/1 request includes both an absolute-form request-target and a conflicting Host header, Netty incorrectly prioritizes the Host header for the HTTP/2 :authority field, discarding the original request-target authority. This inconsistency can allow an attacker to bypass security controls in Netty-based proxies or gateways, potentially leading to unauthorized access, cache poisoning, or misrouting of requests.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "io.netty/netty-codec-http2: HTTP/1 absolute-form Host mismatch is translated to HTTP/2 :authority, overriding the request-target authority",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Important flaw in Netty-based HTTP/1 to HTTP/2 proxies or gateways allows an unauthenticated remote attacker to bypass security policies. The inconsistency in translating the HTTP/1 Host header to HTTP/2 :authority can lead to host or tenant security boundary bypasses, cache poisoning, or unintended request routing, despite initial security checks.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat build of Keycloak 26.6.8"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-93569"
        },
        {
          "category": "external",
          "summary": "RHBZ#2536962",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2536962"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-93569",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-93569"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-93569",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-93569"
        }
      ],
      "release_date": "2026-09-10T00:51:06+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-06T10:21:57+00:00",
          "details": "Before applying the update, back up your existing installation,\nincluding all applications, configuration files, databases and\ndatabase settings, and so on.",
          "product_ids": [
            "Red Hat build of Keycloak 26.6.8"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:95761"
        },
        {
          "category": "workaround",
          "details": "See https://github.com/netty/netty/security/advisories/GHSA-cg2g-fxr4-mg8m for fixed versions and remediation guidance.",
          "product_ids": [
            "Red Hat build of Keycloak 26.6.8"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat build of Keycloak 26.6.8"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "io.netty/netty-codec-http2: HTTP/1 absolute-form Host mismatch is translated to HTTP/2 :authority, overriding the request-target authority"
    },
    {
      "cve": "CVE-2026-93573",
      "cwe": {
        "id": "CWE-444",
        "name": "Inconsistent Interpretation of HTTP Requests"
      },
      "discovery_date": "2026-09-10T00:52:26+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2536964"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Netty\u0027s HTTP/1.1 decoder. This vulnerability allows a remote attacker to bypass `Transfer-Encoding` header validation by splitting the `Transfer-Encoding` field across multiple headers, with the last field containing a non-final transfer coding like `gzip` or `deflate`. This bypass can lead to HTTP request smuggling, enabling attackers to bypass security controls, desynchronize request processing, or cause requests to be processed in an unintended context.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "io.netty/netty-codec-http: Netty split Transfer-Encoding fields bypass final-chunked validation and enable request smuggling",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This flaw in Netty\u0027s HTTP/1.1 decoder allows for HTTP request smuggling by incorrectly processing split `Transfer-Encoding` headers. When Netty is deployed with an intermediary that interprets these headers differently, an attacker could bypass front-end security controls or desynchronize request processing.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat build of Keycloak 26.6.8"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-93573"
        },
        {
          "category": "external",
          "summary": "RHBZ#2536964",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2536964"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-93573",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-93573"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-93573",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-93573"
        }
      ],
      "release_date": "2026-09-10T00:52:26+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-06T10:21:57+00:00",
          "details": "Before applying the update, back up your existing installation,\nincluding all applications, configuration files, databases and\ndatabase settings, and so on.",
          "product_ids": [
            "Red Hat build of Keycloak 26.6.8"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:95761"
        },
        {
          "category": "workaround",
          "details": "See https://github.com/netty/netty/security/advisories/GHSA-3jrc-fchc-59pw for fixed versions and remediation guidance.",
          "product_ids": [
            "Red Hat build of Keycloak 26.6.8"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat build of Keycloak 26.6.8"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "io.netty/netty-codec-http: Netty split Transfer-Encoding fields bypass final-chunked validation and enable request smuggling"
    },
    {
      "cve": "CVE-2026-93574",
      "cwe": {
        "id": "CWE-444",
        "name": "Inconsistent Interpretation of HTTP Requests"
      },
      "discovery_date": "2026-09-10T00:52:52+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2536966"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Netty\u0027s `netty-codec-http` component. A remote attacker could exploit this vulnerability by sending a specially crafted HTTP/1.1 chunk-size token that includes post-digit whitespace. This incorrect parsing of the chunk size can lead to HTTP request smuggling. This allows an attacker to bypass security controls or access unauthorized resources in proxy/backend deployments.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "io.netty/netty-codec-http: Netty: HTTP request smuggling via post-digit whitespace in chunk-size parsing",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Moderate severity flaw in Netty\u0027s HTTP/1.1 chunk-size parsing allows for HTTP request smuggling in proxy/backend deployments. By accepting post-digit whitespace in chunk-size tokens, Netty can misinterpret malformed chunked bodies, leading to a desynchronization between Netty and other HTTP components in the request path. This could enable an attacker to smuggle requests, potentially bypassing security controls or accessing unauthorized resources.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat build of Keycloak 26.6.8"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-93574"
        },
        {
          "category": "external",
          "summary": "RHBZ#2536966",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2536966"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-93574",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-93574"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-93574",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-93574"
        }
      ],
      "release_date": "2026-09-10T00:52:52+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-06T10:21:57+00:00",
          "details": "Before applying the update, back up your existing installation,\nincluding all applications, configuration files, databases and\ndatabase settings, and so on.",
          "product_ids": [
            "Red Hat build of Keycloak 26.6.8"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:95761"
        },
        {
          "category": "workaround",
          "details": "See https://github.com/netty/netty/security/advisories/GHSA-j4mg-hqgv-34qc for fixed versions and remediation guidance.",
          "product_ids": [
            "Red Hat build of Keycloak 26.6.8"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat build of Keycloak 26.6.8"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "io.netty/netty-codec-http: Netty: HTTP request smuggling via post-digit whitespace in chunk-size parsing"
    },
    {
      "cve": "CVE-2026-93579",
      "cwe": {
        "id": "CWE-1035",
        "name": "CWE-1035"
      },
      "discovery_date": "2026-09-10T00:55:17+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2536970"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Netty\u0027s HTTP/2 stack. This vulnerability allows a remote attacker to inject prohibited characters, such as NUL, Line Feed, and Carriage Return, into HTTP/2 header field values due to insufficient validation. When these values cross an HTTP/2 to HTTP/1.1 translation boundary, they can be exploited for request smuggling, header injection, or response splitting. This could lead to unauthorized access, data manipulation, or other security bypasses.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "io.netty/netty-codec-http2: Netty: HTTP/2 header field values are not validated by default (CR/LF/NUL passthrough)",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Moderate flaw in Netty\u0027s HTTP/2 implementation arises from disabled-by-default header value validation. When Netty-based applications act as HTTP/2 to HTTP/1.1 translation proxies or gateways, this can enable request smuggling or response splitting attacks by allowing prohibited control characters to be injected into HTTP/1.1 headers. Pure end-to-end HTTP/2 deployments are not affected.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat build of Keycloak 26.6.8"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-93579"
        },
        {
          "category": "external",
          "summary": "RHBZ#2536970",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2536970"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-93579",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-93579"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-93579",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-93579"
        }
      ],
      "release_date": "2026-09-10T00:55:17+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-06T10:21:57+00:00",
          "details": "Before applying the update, back up your existing installation,\nincluding all applications, configuration files, databases and\ndatabase settings, and so on.",
          "product_ids": [
            "Red Hat build of Keycloak 26.6.8"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:95761"
        },
        {
          "category": "workaround",
          "details": "See https://github.com/netty/netty/security/advisories/GHSA-8whp-c7w8-2m72 for fixed versions and remediation guidance.",
          "product_ids": [
            "Red Hat build of Keycloak 26.6.8"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat build of Keycloak 26.6.8"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "io.netty/netty-codec-http2: Netty: HTTP/2 header field values are not validated by default (CR/LF/NUL passthrough)"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "SECTION: Create Trackers yes"
          ]
        }
      ],
      "cve": "CVE-2026-93998",
      "cwe": {
        "id": "CWE-347",
        "name": "Improper Verification of Cryptographic Signature"
      },
      "discovery_date": "2026-09-18T14:55:12+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2537164"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the SAML adapter component of Keycloak, which is used to secure applications with SAML-based authentication. The adapter fails to verify that the issuer of a signed SAML assertion matches the expected identity provider configured for the application. If multiple identity providers share the same trusted signing key, an attacker who controls one of those providers can create a validly signed assertion to log into the application as any user, potentially gaining full administrative control.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "keycloak-core: keycloak-core: SAML adapter does not bind signed assertions to the configured identity provider issuer",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "The Red Hat Product Security team has assessed the severity of this vulnerability as Important, given that exploitation requires the specific condition of a shared signing key between trusted and untrusted issuers. Successful exploitation allows an attacker to bypass authentication and gain unauthorized access, including administrative privileges, to applications protected by the Keycloak SAML adapter. The vulnerability\u0027s root cause is the failure to validate the SAML assertion issuer against the configured identity provider entity ID.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat build of Keycloak 26.6.8"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-93998"
        },
        {
          "category": "external",
          "summary": "RHBZ#2537164",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2537164"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-93998",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-93998"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-93998",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-93998"
        }
      ],
      "release_date": "2026-11-05T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-06T10:21:57+00:00",
          "details": "Before applying the update, back up your existing installation,\nincluding all applications, configuration files, databases and\ndatabase settings, and so on.",
          "product_ids": [
            "Red Hat build of Keycloak 26.6.8"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:95761"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat build of Keycloak 26.6.8"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat build of Keycloak 26.6.8"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "keycloak-core: keycloak-core: SAML adapter does not bind signed assertions to the configured identity provider issuer"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Moritz Theile"
          ],
          "organization": "@Moritz-cmd"
        }
      ],
      "cve": "CVE-2026-93999",
      "cwe": {
        "id": "CWE-862",
        "name": "Missing Authorization"
      },
      "discovery_date": "2026-09-18T01:00:50+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2537165"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the OIDC protocol implementation of Keycloak, an open-source identity and access management solution. The issue occurs during the token refresh process when the server restores requested audiences from stored client IDs. Keycloak fails to verify if the target audience client is still enabled before issuing a new access token. This allows an application with an existing refresh token to continue obtaining valid access tokens for a disabled client, potentially bypassing administrative access controls for resource servers that rely on offline JWT validation.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "keycloak-services: keycloak-services: Token refresh continues issuing tokens for disabled audience clients",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "The Red Hat Product Security team has assessed the severity of this vulnerability as Moderate, given that exploitation requires a specific sequence of events where a client is disabled after a refresh token has already been issued. Successful exploitation allows an attacker to bypass administrative disablement and continue accessing resource servers that use offline token verification. The vulnerability\u0027s root cause is a failure to validate the enabled status of audience clients during the token refresh and exchange process.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat build of Keycloak 26.6.8"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-93999"
        },
        {
          "category": "external",
          "summary": "RHBZ#2537165",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2537165"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-93999",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-93999"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-93999",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-93999"
        }
      ],
      "release_date": "2026-09-18T01:00:50+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-06T10:21:57+00:00",
          "details": "Before applying the update, back up your existing installation,\nincluding all applications, configuration files, databases and\ndatabase settings, and so on.",
          "product_ids": [
            "Red Hat build of Keycloak 26.6.8"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:95761"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat build of Keycloak 26.6.8"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.2,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat build of Keycloak 26.6.8"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "keycloak-services: keycloak-services: Token refresh continues issuing tokens for disabled audience clients"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "SECTION: Create Trackers {yes"
          ]
        }
      ],
      "cve": "CVE-2026-94000",
      "cwe": {
        "id": "CWE-862",
        "name": "Missing Authorization"
      },
      "discovery_date": "2026-09-18T00:25:25+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2537168"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Admin REST API of Keycloak, an open-source identity and access management solution. The issue occurs in the group-membership endpoints where the system fails to check if a group grants administrative privileges before allowing a user to be added. This allows a delegated administrator with limited permissions to add themselves to a high-privilege group, potentially gaining full control over the entire realm.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "keycloak-services: keycloak-services: Delegated admin with manage-users can escalate to realm-admin via group membership",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "The Red Hat Product Security team has assessed the severity of this vulnerability as Moderate, given that exploitation requires a specific pre-existing configuration (a group mapping administrative roles) and an attacker already possessing high-level delegated administrative privileges. Successful exploitation allows an attacker to escalate their privileges to realm-admin, gaining full control over the affected realm. The vulnerability\u0027s root cause is a failure to validate the administrative implications of group membership changes in the Admin REST API.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat build of Keycloak 26.6.8"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-94000"
        },
        {
          "category": "external",
          "summary": "RHBZ#2537168",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2537168"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-94000",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-94000"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-94000",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-94000"
        }
      ],
      "release_date": "2026-09-18T00:25:25+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-06T10:21:57+00:00",
          "details": "Before applying the update, back up your existing installation,\nincluding all applications, configuration files, databases and\ndatabase settings, and so on.",
          "product_ids": [
            "Red Hat build of Keycloak 26.6.8"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:95761"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat build of Keycloak 26.6.8"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.6,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat build of Keycloak 26.6.8"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "keycloak-services: keycloak-services: Delegated admin with manage-users can escalate to realm-admin via group membership"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Paul Bottinelli of Trail of Bits in collaboration with OpenAI"
          ]
        }
      ],
      "cve": "CVE-2026-94001",
      "cwe": {
        "id": "CWE-862",
        "name": "Missing Authorization"
      },
      "discovery_date": "2026-09-18T00:01:42+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2537169"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Admin REST API of Keycloak, an open-source identity and access management solution. The endpoint used for deleting user credentials does not correctly check for fine-grained reset-password permissions. This allows a delegated administrator, who should be restricted from resetting passwords, to delete a user\u0027s password credentials, resulting in the user being unable to log in.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "keycloak-services: keycloak-services: Admin credential DELETE bypasses denied reset-password permission",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "The Red Hat Product Security team has assessed the severity of this vulnerability as Moderate, given that exploitation requires high privileges as a delegated administrator. Successful exploitation allows an attacker to delete user credentials and cause account lockout, bypassing intended fine-grained permission restrictions. The vulnerability\u0027s root cause is a missing authorization check for the reset-password permission in the credential deletion API endpoint.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat build of Keycloak 26.6.8"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-94001"
        },
        {
          "category": "external",
          "summary": "RHBZ#2537169",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2537169"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-94001",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-94001"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-94001",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-94001"
        }
      ],
      "release_date": "2026-09-18T00:01:42+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-06T10:21:57+00:00",
          "details": "Before applying the update, back up your existing installation,\nincluding all applications, configuration files, databases and\ndatabase settings, and so on.",
          "product_ids": [
            "Red Hat build of Keycloak 26.6.8"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:95761"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat build of Keycloak 26.6.8"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat build of Keycloak 26.6.8"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "keycloak-services: keycloak-services: Admin credential DELETE bypasses denied reset-password permission"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Maksim Hayder",
            "Amr Al Hallak (v4yne1)"
          ]
        }
      ],
      "cve": "CVE-2026-94213",
      "cwe": {
        "id": "CWE-862",
        "name": "Missing Authorization"
      },
      "discovery_date": "2026-09-20T02:56:24+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2537310"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Authorization Services component of Keycloak, an open-source identity and access management solution. The issue occurs in the policy evaluation endpoint, which is used by administrators to test how access policies apply to specific users. Due to missing authorization checks, a delegated administrator with limited viewing privileges can access the full profile and role information of any user in the realm, even if they are not permitted to view user details. This could lead to the exposure of sensitive information such as email addresses and assigned security roles.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "keycloak-services: keycloak-services: Authorization Services policy evaluation endpoint leaks user identity",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "The Red Hat Product Security team has assessed the severity of this vulnerability as Moderate, given that exploitation requires the attacker to already possess high-level administrative privileges within a specific client or resource server. Successful exploitation allows an attacker to view sensitive user profile information and role mappings that they are otherwise restricted from seeing. The vulnerability\u0027s root cause is a missing authorization check in the Authorization Services policy evaluation logic.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat build of Keycloak 26.6.8"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-94213"
        },
        {
          "category": "external",
          "summary": "RHBZ#2537310",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2537310"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-94213",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-94213"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-94213",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-94213"
        }
      ],
      "release_date": "2026-09-20T02:56:24+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-06T10:21:57+00:00",
          "details": "Before applying the update, back up your existing installation,\nincluding all applications, configuration files, databases and\ndatabase settings, and so on.",
          "product_ids": [
            "Red Hat build of Keycloak 26.6.8"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:95761"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat build of Keycloak 26.6.8"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat build of Keycloak 26.6.8"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "keycloak-services: keycloak-services: Authorization Services policy evaluation endpoint leaks user identity"
    },
    {
      "cve": "CVE-2026-94215",
      "cwe": {
        "id": "CWE-862",
        "name": "Missing Authorization"
      },
      "discovery_date": "2026-09-20T01:54:31+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2537312"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Admin REST API of Keycloak, an open-source identity and access management solution. The issue occurs because the API uses a per-request in-memory cache to resolve clients by their unique identifier without verifying if the client belongs to the realm specified in the request path. This allows an administrator with limited privileges to read or modify sensitive client configurations in the master realm by accessing them through a realm they control. Successful exploitation could lead to the exposure of client credentials or the redirection of administrative login attempts to malicious sites.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "keycloak-services: keycloak-services: Cross-realm client read/write via request-level cache missing realm ownership check",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "The Red Hat Product Security team has assessed the severity of this vulnerability as Moderate, given that exploitation requires high privileges (create-realm role) and knowledge of specific, non-public client UUIDs. Successful exploitation allows an attacker to read sensitive client credentials and modify client configurations in the master realm, potentially leading to open redirects. The vulnerability\u0027s root cause is a missing realm ownership check in the per-request in-memory cache used by the Admin REST API.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat build of Keycloak 26.6.8"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-94215"
        },
        {
          "category": "external",
          "summary": "RHBZ#2537312",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2537312"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-94215",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-94215"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-94215",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-94215"
        }
      ],
      "release_date": "2026-09-20T01:54:31+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-06T10:21:57+00:00",
          "details": "Before applying the update, back up your existing installation,\nincluding all applications, configuration files, databases and\ndatabase settings, and so on.",
          "product_ids": [
            "Red Hat build of Keycloak 26.6.8"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:95761"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat build of Keycloak 26.6.8"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:H/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat build of Keycloak 26.6.8"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "keycloak-services: keycloak-services: Cross-realm client read/write via request-level cache missing realm ownership check"
    },
    {
      "cve": "CVE-2026-94217",
      "cwe": {
        "id": "CWE-862",
        "name": "Missing Authorization"
      },
      "discovery_date": "2026-09-19T23:39:17+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2537313"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the User-Managed Access (UMA) implementation of Keycloak. The issue occurs in the authorization token endpoint when processing permission tickets. If two different users own resources with the same name, the system incorrectly merges the permissions from both resources when one user requests an authorization token. This allows an attacker to gain access scopes on a victim\u0027s resource that were never intended to be shared.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "keycloak-services: keycloak-services: UMA scope merge across resource owners via resource name collision",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "The Red Hat Product Security team has assessed the severity of this vulnerability as Moderate, given that exploitation requires a specific resource name collision and prior user interaction by the victim. Successful exploitation allows an attacker to gain unauthorized scopes on a victim\u0027s UMA resource. The vulnerability\u0027s root cause is the improper isolation of resources by owner during the permission ticket lookup process in the authorization token endpoint.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat build of Keycloak 26.6.8"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-94217"
        },
        {
          "category": "external",
          "summary": "RHBZ#2537313",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2537313"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-94217",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-94217"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-94217",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-94217"
        }
      ],
      "release_date": "2026-09-19T23:39:17+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-06T10:21:57+00:00",
          "details": "Before applying the update, back up your existing installation,\nincluding all applications, configuration files, databases and\ndatabase settings, and so on.",
          "product_ids": [
            "Red Hat build of Keycloak 26.6.8"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:95761"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat build of Keycloak 26.6.8"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.5,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat build of Keycloak 26.6.8"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "keycloak-services: keycloak-services: UMA scope merge across resource owners via resource name collision"
    },
    {
      "cve": "CVE-2026-94218",
      "cwe": {
        "id": "CWE-862",
        "name": "Missing Authorization"
      },
      "discovery_date": "2026-09-19T20:22:03+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2537314"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the authentication session management of Keycloak, an identity and access management solution. The issue occurs when an administrator enforces a stronger authentication flow, such as mandatory two-factor authentication (2FA) setup, through a client policy. A user can bypass this requirement by manually visiting a specific session restart web link during the login process. This action clears the internal markers that track the required security steps, allowing the user to log in with only a password and gain access without completing the mandated 2FA setup.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "keycloak-services: keycloak-services: 2FA setup enforcement bypass via authentication session restart endpoint",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "The Red Hat Product Security team has assessed the severity of this vulnerability as Low, given that exploitation requires a specific server-side configuration (client policy with auth-flow-enforcer) and only affects users who have not yet enrolled in 2FA. Successful exploitation allows an attacker to bypass a mandated 2FA setup step and receive a token at the realms default authentication level. The vulnerabilitys root cause is the improper clearing of authentication session notes at the restart endpoint without re-evaluating active client policies.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat build of Keycloak 26.6.8"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-94218"
        },
        {
          "category": "external",
          "summary": "RHBZ#2537314",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2537314"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-94218",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-94218"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-94218",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-94218"
        }
      ],
      "release_date": "2026-09-19T20:22:03+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-06T10:21:57+00:00",
          "details": "Before applying the update, back up your existing installation,\nincluding all applications, configuration files, databases and\ndatabase settings, and so on.",
          "product_ids": [
            "Red Hat build of Keycloak 26.6.8"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:95761"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat build of Keycloak 26.6.8"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.1,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat build of Keycloak 26.6.8"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "keycloak-services: keycloak-services: 2FA setup enforcement bypass via authentication session restart endpoint"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Leo Jianze"
          ],
          "organization": "lijianze98@gmail.com"
        }
      ],
      "cve": "CVE-2026-95503",
      "cwe": {
        "id": "CWE-347",
        "name": "Improper Verification of Cryptographic Signature"
      },
      "discovery_date": "2026-09-21T11:04:40+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2537744"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Kerberos federation provider of Keycloak, an open-source identity and access management solution. When Kerberos password authentication is used without SPNEGO, the system fails to verify the identity of the Key Distribution Center (KDC) by requesting a server ticket. This allows an attacker on the same network to spoof the KDC and bypass the authentication process, potentially gaining unauthorized access to user accounts.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "keycloak-services: keycloak-services: Potential KDC spoofing bypass when Kerberos password authentication is enabled",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "The Red Hat Product Security team has assessed the severity of this vulnerability as Important, given that it allows for a complete authentication bypass. Successful exploitation allows an attacker to impersonate users and gain unauthorized access to the system. The vulnerability\u0027s root cause is the lack of server ticket verification when Kerberos password authentication is used, failing to ensure the authenticity of the KDC.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat build of Keycloak 26.6.8"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-95503"
        },
        {
          "category": "external",
          "summary": "RHBZ#2537744",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2537744"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-95503",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-95503"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-95503",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-95503"
        }
      ],
      "release_date": "2026-09-22T07:23:16.556000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-06T10:21:57+00:00",
          "details": "Before applying the update, back up your existing installation,\nincluding all applications, configuration files, databases and\ndatabase settings, and so on.",
          "product_ids": [
            "Red Hat build of Keycloak 26.6.8"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:95761"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat build of Keycloak 26.6.8"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat build of Keycloak 26.6.8"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "keycloak-services: keycloak-services: Potential KDC spoofing bypass when Kerberos password authentication is enabled"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Paul Bottinelli"
          ],
          "organization": "Trail of Bits in collaboration with OpenAI"
        }
      ],
      "cve": "CVE-2026-96445",
      "cwe": {
        "id": "CWE-287",
        "name": "Improper Authentication"
      },
      "discovery_date": "2026-09-22T15:35:51+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2539280"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Conditional OTP authenticator of Keycloak, an identity and access management solution. The issue occurs when the system evaluates specific HTTP headers to determine if a one-time password (OTP) should be skipped, but fails to verify if those headers came from a trusted source. This could allow an attacker who already has a user\u0027s password to bypass the second-factor authentication by providing a specially crafted header in their request.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "keycloak-services: keycloak-services: Conditional OTP skip-header policy evaluated against untrusted proxy headers",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "The Red Hat Product Security team has assessed the severity of this vulnerability as Moderate, given that exploitation requires the attacker to have already obtained a user\u0027s password and for the realm to be using a specific, non-default Conditional OTP configuration. Successful exploitation allows an attacker to bypass the second-factor authentication (OTP) and gain unauthorized access to a user\u0027s account. The vulnerability\u0027s root cause is the failure to validate the trustworthiness of proxy headers before using them to evaluate authentication skip rules.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat build of Keycloak 26.6.8"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-96445"
        },
        {
          "category": "external",
          "summary": "RHBZ#2539280",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2539280"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-96445",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-96445"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-96445",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-96445"
        }
      ],
      "release_date": "2026-09-22T15:35:51+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-06T10:21:57+00:00",
          "details": "Before applying the update, back up your existing installation,\nincluding all applications, configuration files, databases and\ndatabase settings, and so on.",
          "product_ids": [
            "Red Hat build of Keycloak 26.6.8"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:95761"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat build of Keycloak 26.6.8"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat build of Keycloak 26.6.8"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "keycloak-services: keycloak-services: Conditional OTP skip-header policy evaluated against untrusted proxy headers"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "EVIL0RD"
          ],
          "organization": "Independent Security Researcher"
        }
      ],
      "cve": "CVE-2026-96446",
      "cwe": {
        "id": "CWE-862",
        "name": "Missing Authorization"
      },
      "discovery_date": "2026-09-22T14:37:44+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2539284"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Pushed Authorization Request PAR implementation of Keycloak. The issue occurs when the silent authentication path prompt=none is used, which allows the authorization process to skip certain steps if a user is already logged in. Due to this bypass, the security rule that ensures a pushed request URI is used only once is not enforced. An attacker could potentially reuse a request URI to obtain multiple authorization codes for a user who is already signed in, violating security standards like FAPI-2.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "keycloak-services: keycloak-services: PAR single-use bypass via prompt=none silent authentication path",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "The Red Hat Product Security team has assessed the severity of this vulnerability as Moderate, given that exploitation requires an existing SSO session for the target user and valid client credentials. Successful exploitation allows an attacker to replay a pushed authorization request URI to obtain multiple valid authorization codes. The vulnerability\u0027s root cause is a logic error where the PAR consumption and deletion logic is bypassed during the silent authentication prompt=none flow.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat build of Keycloak 26.6.8"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-96446"
        },
        {
          "category": "external",
          "summary": "RHBZ#2539284",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2539284"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-96446",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-96446"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-96446",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-96446"
        }
      ],
      "release_date": "2026-09-22T14:37:44+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-06T10:21:57+00:00",
          "details": "Before applying the update, back up your existing installation,\nincluding all applications, configuration files, databases and\ndatabase settings, and so on.",
          "product_ids": [
            "Red Hat build of Keycloak 26.6.8"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:95761"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat build of Keycloak 26.6.8"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.2,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat build of Keycloak 26.6.8"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "keycloak-services: keycloak-services: PAR single-use bypass via prompt=none silent authentication path"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Bruno Oliveira of IBM in collaboration with OpenAI"
          ]
        }
      ],
      "cve": "CVE-2026-96447",
      "cwe": {
        "id": "CWE-287",
        "name": "Improper Authentication"
      },
      "discovery_date": "2026-09-22T12:56:03+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2539288"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the TokenManager component of Keycloak, an open-source identity and access management solution. The issue occurs during the validation of stateless access tokens when the original user ID no longer exists. Keycloak incorrectly falls back to using the username to identify the user without verifying if the identity matches the original token subject. This could allow an attacker with an old token to gain access to a newly created service account if it shares the same client ID as a previously deleted one.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "keycloak-services: keycloak-services: Stateless token preferred_username fallback enables identity rebinding",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "The Red Hat Product Security team has assessed the severity of this vulnerability as Moderate, given that exploitation requires an administrator to delete and recreate a client with the same ID while an attacker holds a valid stateless token from the original client. Successful exploitation allows an attacker to gain the identity and permissions of the replacement service account. The vulnerability\u0027s root cause is an improper fallback to username-based resolution in stateless token validation without verifying the binding to the original token subject.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat build of Keycloak 26.6.8"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-96447"
        },
        {
          "category": "external",
          "summary": "RHBZ#2539288",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2539288"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-96447",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-96447"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-96447",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-96447"
        }
      ],
      "release_date": "2026-11-05T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-06T10:21:57+00:00",
          "details": "Before applying the update, back up your existing installation,\nincluding all applications, configuration files, databases and\ndatabase settings, and so on.",
          "product_ids": [
            "Red Hat build of Keycloak 26.6.8"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:95761"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat build of Keycloak 26.6.8"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.2,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat build of Keycloak 26.6.8"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "keycloak-services: keycloak-services: Stateless token preferred_username fallback enables identity rebinding"
    },
    {
      "cve": "CVE-2026-96448",
      "cwe": {
        "id": "CWE-285",
        "name": "Improper Authorization"
      },
      "discovery_date": "2026-09-22T12:47:58+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2539291"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Fine-Grained Admin Permissions (FGAP v2) feature of Keycloak, an identity and access management solution. The issue occurs when the system checks if a delegated administrator has permission to assign a specific role to a user. Because the check does not look inside composite roles to see what other permissions they contain, an administrator with limited rights can assign a role that secretly includes full administrative control. This allows the attacker to gain complete management access over the entire realm.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "keycloak-services: keycloak-services: FGAP v2 composite-blind role mapping allows privilege escalation",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "The Red Hat Product Security team has assessed the severity of this vulnerability as Important, given that exploitation requires a specific pre-existing configuration where a composite role containing privileged permissions is already present. Successful exploitation allows an attacker to escalate their privileges to full realm-admin, granting them complete control over the affected realm. The vulnerability\u0027s root cause is a failure to perform recursive authorization checks on composite roles during the role-mapping process in FGAP v2.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat build of Keycloak 26.6.8"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-96448"
        },
        {
          "category": "external",
          "summary": "RHBZ#2539291",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2539291"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-96448",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-96448"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-96448",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-96448"
        }
      ],
      "release_date": "2026-09-25T07:14:47.013000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-06T10:21:57+00:00",
          "details": "Before applying the update, back up your existing installation,\nincluding all applications, configuration files, databases and\ndatabase settings, and so on.",
          "product_ids": [
            "Red Hat build of Keycloak 26.6.8"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:95761"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat build of Keycloak 26.6.8"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.6,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat build of Keycloak 26.6.8"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "keycloak-services: keycloak-services: FGAP v2 composite-blind role mapping allows privilege escalation"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Paul Bottinelli"
          ],
          "organization": "Trail of Bits in collaboration with OpenAI"
        }
      ],
      "cve": "CVE-2026-96453",
      "cwe": {
        "id": "CWE-295",
        "name": "Improper Certificate Validation"
      },
      "discovery_date": "2026-09-22T12:44:17+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2539294"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Keycloak Admin CLI kcadm tool, which is used by administrators to manage Keycloak servers from the command line. When a custom truststore is provided to verify the server identity, the tool incorrectly accepts any self-signed certificate as long as the hostname matches. This allows a network attacker to impersonate the Keycloak server, steal administrative credentials, and perform unauthorized management actions.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "org.keycloak/keycloak-admin-cli: keycloak-admin-cli: kcadm custom truststore accepts arbitrary self-signed certificates",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "The Red Hat Product Security team has assessed the severity of this vulnerability as Important, given that exploitation requires the attacker to be in a position to intercept network traffic and the administrator to be using a custom truststore configuration. Successful exploitation allows an attacker to capture administrative credentials and perform unauthorized administrative actions on the Keycloak server. The vulnerability root cause is the improper implementation of the trust strategy in the Admin CLI HTTP client, which defaults to accepting self-signed certificates when a truststore is provided.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat build of Keycloak 26.6.8"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-96453"
        },
        {
          "category": "external",
          "summary": "RHBZ#2539294",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2539294"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-96453",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-96453"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-96453",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-96453"
        }
      ],
      "release_date": "2026-11-05T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-06T10:21:57+00:00",
          "details": "Before applying the update, back up your existing installation,\nincluding all applications, configuration files, databases and\ndatabase settings, and so on.",
          "product_ids": [
            "Red Hat build of Keycloak 26.6.8"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:95761"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat build of Keycloak 26.6.8"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.0,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat build of Keycloak 26.6.8"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "org.keycloak/keycloak-admin-cli: keycloak-admin-cli: kcadm custom truststore accepts arbitrary self-signed certificates"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Stian Thorgersen"
          ],
          "organization": "IBM"
        }
      ],
      "cve": "CVE-2026-96460",
      "cwe": {
        "id": "CWE-303",
        "name": "Incorrect Implementation of Authentication Algorithm"
      },
      "discovery_date": "2026-09-22T12:22:52+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2539301"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the token exchange mechanism of Keycloak. When using Standard Token Exchange V2, the system issues new tokens with a fresh lifetime based on the requester clients configuration instead of limiting it to the original tokens expiration. This issue allows an authenticated requester to indefinitely extend access for service accounts by repeatedly exchanging tokens, even if the original client has been disabled by an administrator.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "keycloak-services: keycloak-services: Indefinite access token renewal via Standard Token Exchange V2",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "The Red Hat Product Security team has assessed the severity of this vulnerability as Moderate, given that exploitation requires the attacker to already possess a valid exchanged service-account token and the credentials of an authorized requester client. Successful exploitation allows an attacker to maintain persistent access to resources indefinitely, bypassing administrative revocation of the origin client. The vulnerability\u0027s root cause is the failure to bound exchanged token lifetimes by the original subject token\u0027s expiration.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat build of Keycloak 26.6.8"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-96460"
        },
        {
          "category": "external",
          "summary": "RHBZ#2539301",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2539301"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-96460",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-96460"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-96460",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-96460"
        }
      ],
      "release_date": "2026-11-05T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-06T10:21:57+00:00",
          "details": "Before applying the update, back up your existing installation,\nincluding all applications, configuration files, databases and\ndatabase settings, and so on.",
          "product_ids": [
            "Red Hat build of Keycloak 26.6.8"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:95761"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat build of Keycloak 26.6.8"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat build of Keycloak 26.6.8"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "keycloak-services: keycloak-services: Indefinite access token renewal via Standard Token Exchange V2"
    },
    {
      "cve": "CVE-2026-96547",
      "cwe": {
        "id": "CWE-862",
        "name": "Missing Authorization"
      },
      "discovery_date": "2026-09-23T12:30:28+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2539387"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Dynamic Client Registration component of Keycloak, an open-source identity and access management solution. The issue occurs because the system does not properly restrict which claim names can be used when setting up new clients. An attacker with valid registration credentials could create a client that incorrectly maps standard user profile information to sensitive security roles, potentially allowing them to gain unauthorized privileges on external applications that trust Keycloak tokens.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "keycloak-services: keycloak-services: DCR registration-time claim-path gap allows forging realm_access.roles",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "The Red Hat Product Security team has assessed the severity of this vulnerability as Moderate, given that exploitation requires a valid Initial Access Token and only impacts external relying parties that rely on token claims for authorization. Successful exploitation allows an attacker to forge realm roles in tokens issued to these parties, potentially leading to privilege escalation. The vulnerability\u0027s root cause is a lack of claim name restriction during the Dynamic Client Registration process.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat build of Keycloak 26.6.8"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-96547"
        },
        {
          "category": "external",
          "summary": "RHBZ#2539387",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2539387"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-96547",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-96547"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-96547",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-96547"
        }
      ],
      "release_date": "2026-11-05T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-06T10:21:57+00:00",
          "details": "Before applying the update, back up your existing installation,\nincluding all applications, configuration files, databases and\ndatabase settings, and so on.",
          "product_ids": [
            "Red Hat build of Keycloak 26.6.8"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:95761"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat build of Keycloak 26.6.8"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat build of Keycloak 26.6.8"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "keycloak-services: keycloak-services: DCR registration-time claim-path gap allows forging realm_access.roles"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Amr Al Hallak"
          ],
          "organization": "v4yne1"
        }
      ],
      "cve": "CVE-2026-97174",
      "cwe": {
        "id": "CWE-20",
        "name": "Improper Input Validation"
      },
      "discovery_date": "2026-09-23T15:54:31+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2539961"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Client-Initiated Backchannel Authentication (CIBA) implementation of Keycloak. The CIBA endpoint fails to properly validate the sub parameter, allowing it to be stored as an additional request parameter. During the token issuance process, this injected value overwrites the legitimate subject identifier. This allows an attacker to authenticate as themselves but receive security tokens belonging to a different victim user, leading to unauthorized account access.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "keycloak-services: keycloak-services: CIBA sub parameter injection causes attacker authentication to issue victim tokens",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "The Red Hat Product Security team has assessed the severity of this vulnerability as Important, given that it allows for direct privilege escalation and unauthorized access to victim accounts. Successful exploitation allows an attacker to obtain access and ID tokens for any user in the realm without the victim\u0027s knowledge or interaction. The vulnerability\u0027s root cause is the improper handling and flattening of additional request parameters during the serialization of CIBA authentication requests, which allows a duplicate subject claim to overwrite the legitimate one.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat build of Keycloak 26.6.8"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-97174"
        },
        {
          "category": "external",
          "summary": "RHBZ#2539961",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2539961"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-97174",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-97174"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-97174",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-97174"
        }
      ],
      "release_date": "2026-11-05T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-06T10:21:57+00:00",
          "details": "Before applying the update, back up your existing installation,\nincluding all applications, configuration files, databases and\ndatabase settings, and so on.",
          "product_ids": [
            "Red Hat build of Keycloak 26.6.8"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:95761"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat build of Keycloak 26.6.8"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat build of Keycloak 26.6.8"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "keycloak-services: keycloak-services: CIBA sub parameter injection causes attacker authentication to issue victim tokens"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "ProofSpear Security Labs"
          ],
          "organization": "research@proofspear.io"
        }
      ],
      "cve": "CVE-2026-97175",
      "cwe": {
        "id": "CWE-287",
        "name": "Improper Authentication"
      },
      "discovery_date": "2026-09-23T14:46:34+00:00",
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the idp-auto-link authenticator of the keycloak-services component, which handles user identity federation. The issue occurs when Keycloak automatically links an incoming identity from an external provider to an existing local account based on an email address without verifying if the provider has validated that email. This can allow an attacker to take over a victim\u0027s account by using a matching unverified email address at a brokered provider.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "keycloak-services: keycloak-services: Unverified IdP email auto-linking enables account takeover",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "The Red Hat Product Security team has assessed the severity of this vulnerability as Important, given that an attacker must possess an account at a brokered identity provider. Successful exploitation allows an attacker to perform a full account takeover, including changing the victim\u0027s email and password. The vulnerability\u0027s root cause is the failure to verify the email verified claim before automatically linking and authenticating a federated identity to an existing local account.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat build of Keycloak 26.6.8"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-97175"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-97175",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-97175"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-97175",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-97175"
        }
      ],
      "release_date": "2026-11-05T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-06T10:21:57+00:00",
          "details": "Before applying the update, back up your existing installation,\nincluding all applications, configuration files, databases and\ndatabase settings, and so on.",
          "product_ids": [
            "Red Hat build of Keycloak 26.6.8"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:95761"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat build of Keycloak 26.6.8"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat build of Keycloak 26.6.8"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "keycloak-services: keycloak-services: Unverified IdP email auto-linking enables account takeover"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Paul Bottinelli of Trail of Bits in collaboration with OpenAI"
          ]
        }
      ],
      "cve": "CVE-2026-97177",
      "cwe": {
        "id": "CWE-862",
        "name": "Missing Authorization"
      },
      "discovery_date": "2026-09-23T13:11:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2539965"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the user update mechanism of the Keycloak Admin REST API. When Fine-Grained Admin Permissions are enabled, the system fails to check for specific password reset authorizations during a general user profile update. This allows a delegated administrator, who should be restricted from resetting passwords, to change a user\u0027s credentials and take over their account.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "keycloak-services: keycloak-services: Generic user update bypasses denied reset-password permission",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "The Red Hat Product Security team has assessed the severity of this vulnerability as Moderate, given that it requires Fine-Grained Admin Permissions to be enabled and the attacker must already possess delegated administrator privileges. Successful exploitation allows an attacker to perform an account takeover by bypassing explicit permission denials to reset user passwords. The vulnerability\u0027s root cause is a missing authorization check in the user update REST API endpoint.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat build of Keycloak 26.6.8"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-97177"
        },
        {
          "category": "external",
          "summary": "RHBZ#2539965",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2539965"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-97177",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-97177"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-97177",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-97177"
        }
      ],
      "release_date": "2026-09-23T13:11:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-06T10:21:57+00:00",
          "details": "Before applying the update, back up your existing installation,\nincluding all applications, configuration files, databases and\ndatabase settings, and so on.",
          "product_ids": [
            "Red Hat build of Keycloak 26.6.8"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:95761"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat build of Keycloak 26.6.8"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.6,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat build of Keycloak 26.6.8"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "keycloak-services: keycloak-services: Generic user update bypasses denied reset-password permission"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Nomit Vyas"
          ]
        }
      ],
      "cve": "CVE-2026-97311",
      "cwe": {
        "id": "CWE-862",
        "name": "Missing Authorization"
      },
      "discovery_date": "2026-09-22T14:36:19+00:00",
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Admin REST API of Keycloak, an identity and access management solution. The endpoints used to retrieve groups associated with a specific role do not properly check for individual group visibility permissions. This allows a delegated administrator with basic search privileges to view detailed information about all groups assigned to a role, bypassing intended security restrictions that should limit their view to specific groups.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "keycloak-services: keycloak-services: Admin REST API role-groups endpoint discloses groups without authorization",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "The Red Hat Product Security team has assessed the severity of this vulnerability as Moderate, given that exploitation requires the attacker to already possess delegated administrative privileges. Successful exploitation allows an attacker to bypass fine-grained visibility controls to disclose group metadata and membership information. The vulnerability\u0027s root cause is a missing authorization check in the Admin REST API\u0027s group retrieval logic for roles.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat build of Keycloak 26.6.8"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-97311"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-97311",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-97311"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-97311",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-97311"
        }
      ],
      "release_date": "2026-09-22T14:36:19+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-06T10:21:57+00:00",
          "details": "Before applying the update, back up your existing installation,\nincluding all applications, configuration files, databases and\ndatabase settings, and so on.",
          "product_ids": [
            "Red Hat build of Keycloak 26.6.8"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:95761"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat build of Keycloak 26.6.8"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat build of Keycloak 26.6.8"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "keycloak-services: keycloak-services: Admin REST API role-groups endpoint discloses groups without authorization"
    },
    {
      "cve": "CVE-2026-97367",
      "cwe": {
        "id": "CWE-287",
        "name": "Improper Authentication"
      },
      "discovery_date": "2026-09-24T13:48:46+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2540080"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Keycloak Account REST API where it incorrectly handles session identification. A malicious client owner can manipulate their own security tokens to point to a different user\u0027s active session. This allows the attacker to access and modify the victim\u0027s account information, potentially leading to a full account takeover by changing the recovery email and resetting the password.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "keycloak-services: keycloak-services: DCR azp and sid claim substitution allows Account REST session takeover",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "The Red Hat Product Security team has assessed the severity of this vulnerability as Moderate, given that exploitation requires the attacker to possess client registration privileges and relies on specific session timing and user interaction. Successful exploitation allows an attacker to read and modify victim account data, potentially leading to full account takeover. The vulnerability\u0027s root cause is the lack of validation between the token subject and the resolved session user, combined with the ability to map sensitive claims like sid via DCR.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat build of Keycloak 26.6.8"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-97367"
        },
        {
          "category": "external",
          "summary": "RHBZ#2540080",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2540080"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-97367",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-97367"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-97367",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-97367"
        }
      ],
      "release_date": "2026-11-05T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-06T10:21:57+00:00",
          "details": "Before applying the update, back up your existing installation,\nincluding all applications, configuration files, databases and\ndatabase settings, and so on.",
          "product_ids": [
            "Red Hat build of Keycloak 26.6.8"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:95761"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat build of Keycloak 26.6.8"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat build of Keycloak 26.6.8"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "keycloak-services: keycloak-services: DCR azp and sid claim substitution allows Account REST session takeover"
    },
    {
      "cve": "CVE-2026-97846",
      "cwe": {
        "id": "CWE-287",
        "name": "Improper Authentication"
      },
      "discovery_date": "2026-09-24T16:58:01+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2540949"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Keycloak provides a feature called mTLS holder-of-key binding which ensures that a token can only be used by the client that originally requested it by binding it to their digital certificate. A flaw was discovered where the new Standard Token Exchange V2 feature does not check for this certificate. This allows an attacker with stolen client credentials to obtain a standard, unrestricted token that bypasses these security protections.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "keycloak-services: keycloak-services: Standard Token Exchange V2 bypasses mTLS holder-of-key binding",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "The Red Hat Product Security team has assessed the severity of this vulnerability as Moderate, given that exploitation requires the attacker to already possess valid client credentials and a valid subject token, and requires specific non-default configurations. Successful exploitation allows an attacker to bypass mTLS sender-constraints and obtain unconstrained Bearer tokens. The vulnerability\u0027s root cause is a missing enforcement check for client certificates in the Standard Token Exchange V2 grant provider.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat build of Keycloak 26.6.8"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-97846"
        },
        {
          "category": "external",
          "summary": "RHBZ#2540949",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2540949"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-97846",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-97846"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-97846",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-97846"
        }
      ],
      "release_date": "2026-09-24T16:58:01+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-06T10:21:57+00:00",
          "details": "Before applying the update, back up your existing installation,\nincluding all applications, configuration files, databases and\ndatabase settings, and so on.",
          "product_ids": [
            "Red Hat build of Keycloak 26.6.8"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:95761"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat build of Keycloak 26.6.8"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat build of Keycloak 26.6.8"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "keycloak-services: keycloak-services: Standard Token Exchange V2 bypasses mTLS holder-of-key binding"
    },
    {
      "cve": "CVE-2026-97847",
      "cwe": {
        "id": "CWE-287",
        "name": "Improper Authentication"
      },
      "discovery_date": "2026-09-24T15:48:58+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2540950"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the protocol mapper and identity resolution components of Keycloak. The issue occurs when a client manager uses hardcoded-claim mappers to override identity claims in sessionless service-account tokens. Because these tokens lack a session ID, Keycloak may incorrectly resolve the token bearer as a different, highly privileged user based on the manipulated claims. This can allow an attacker with limited client management permissions to impersonate a realm administrator and gain full control over the realm.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "keycloak-services: keycloak-services: Client manager can substitute sessionless token principal via hardcoded-claim mappers to obtain realm administrator authority",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "The Red Hat Product Security team has assessed the severity of this vulnerability as Important, given that exploitation requires the attacker to possess specific client management privileges and knowledge of administrative identifiers. Successful exploitation allows an attacker to obtain full realm administrator authority, enabling them to read, modify, or delete any data within the affected realm. The vulnerability\u0027s root cause is an improper identity resolution mechanism that fails to validate the integrity of identity claims in sessionless tokens when protocol mappers are applied.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat build of Keycloak 26.6.8"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-97847"
        },
        {
          "category": "external",
          "summary": "RHBZ#2540950",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2540950"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-97847",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-97847"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-97847",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-97847"
        }
      ],
      "release_date": "2026-11-05T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-06T10:21:57+00:00",
          "details": "Before applying the update, back up your existing installation,\nincluding all applications, configuration files, databases and\ndatabase settings, and so on.",
          "product_ids": [
            "Red Hat build of Keycloak 26.6.8"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:95761"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat build of Keycloak 26.6.8"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat build of Keycloak 26.6.8"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "keycloak-services: keycloak-services: Client manager can substitute sessionless token principal via hardcoded-claim mappers to obtain realm administrator authority"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Katika Mohaseen"
          ],
          "organization": "GitHub: h1-mrz"
        }
      ],
      "cve": "CVE-2026-97848",
      "cwe": {
        "id": "CWE-20",
        "name": "Improper Input Validation"
      },
      "discovery_date": "2026-09-24T13:41:47+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2540960"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the token sanitization logic of Keycloak, an open source identity and access management solution. The issue occurs when a protocol mapper is configured to emit structured claims using the JSON type. The security check designed to remove unauthorized role mappings only looks for standard Java maps and fails to recognize Jackson based JSON objects. This allows an attacker to inject forged client roles into security tokens, which could lead to unauthorized access to protected resources.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "keycloak-services: keycloak-services: Protocol mapper with jsonType=JSON bypasses token sanitization",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "The Red Hat Product Security team has assessed the severity of this vulnerability as Moderate, given that exploitation requires the attacker to have existing client registration privileges or a valid Initial Access Token. Successful exploitation allows an attacker to forge client-role mappings in signed tokens, potentially leading to unauthorized access to resource servers. The vulnerability\u0027s root cause is an incomplete type check in the token sanitization logic that fails to account for Jackson ObjectNode values when jsonType=JSON is used.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat build of Keycloak 26.6.8"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-97848"
        },
        {
          "category": "external",
          "summary": "RHBZ#2540960",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2540960"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-97848",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-97848"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-97848",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-97848"
        }
      ],
      "release_date": "2026-11-05T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-06T10:21:57+00:00",
          "details": "Before applying the update, back up your existing installation,\nincluding all applications, configuration files, databases and\ndatabase settings, and so on.",
          "product_ids": [
            "Red Hat build of Keycloak 26.6.8"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:95761"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat build of Keycloak 26.6.8"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat build of Keycloak 26.6.8"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "keycloak-services: keycloak-services: Protocol mapper with jsonType=JSON bypasses token sanitization"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Limzyallin"
          ]
        }
      ],
      "cve": "CVE-2026-101333",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-09-25T08:30:48+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2542498"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Micrometer user-event metrics listener of Keycloak, a solution for integrated identity and access management. The issue occurs when the listener is configured to include the idp tag. An unauthenticated attacker can send requests to the identity broker login endpoint using arbitrary provider aliases, causing the system to create an unlimited number of metric time series. This can lead to excessive memory consumption and degrade the performance of both the server and its monitoring tools.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "keycloak-services: keycloak-services: Unbounded metric series creation via idp tag on broker login endpoint",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "The Red Hat Product Security team has assessed the severity of this vulnerability as Moderate, given that it requires the Micrometer user-event metrics listener to be explicitly enabled with the idp tag configuration. Successful exploitation allows an attacker to cause resource exhaustion and degrade monitoring performance by creating an unbounded number of metric time series. The vulnerability\u0027s root cause is a lack of cardinality capping for the idp tag in the metrics event listener.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat build of Keycloak 26.6.8"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-101333"
        },
        {
          "category": "external",
          "summary": "RHBZ#2542498",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2542498"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-101333",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-101333"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-101333",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-101333"
        }
      ],
      "release_date": "2026-09-25T08:30:48+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-06T10:21:57+00:00",
          "details": "Before applying the update, back up your existing installation,\nincluding all applications, configuration files, databases and\ndatabase settings, and so on.",
          "product_ids": [
            "Red Hat build of Keycloak 26.6.8"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:95761"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat build of Keycloak 26.6.8"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat build of Keycloak 26.6.8"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "keycloak-services: keycloak-services: Unbounded metric series creation via idp tag on broker login endpoint"
    },
    {
      "cve": "CVE-2026-103112",
      "cwe": {
        "id": "CWE-362",
        "name": "Concurrent Execution using Shared Resource with Improper Synchronization"
      },
      "discovery_date": "2026-09-29T10:16:17+00:00",
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the authentication session handling of the keycloak-services component in Keycloak. The issue occurs because the system fails to verify if an authenticator is valid for the current authentication flow when switching between the standard authentication path and the reset credentials path. An authenticated attacker can exploit this by triggering a race condition during the credential reset process to associate their successful authentication state with another user\u0027s session. This can result in the attacker gaining full access to the victim\u0027s account and changing their password.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "keycloak-services: keycloak-services: Account takeover via authentication race using reset-credentials path",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "The Red Hat Product Security team has assessed the severity of this vulnerability as Important, given that exploitation requires a difficult-to-achieve race condition and specific realm configurations. Successful exploitation allows an attacker to perform a full account takeover, including changing the victim\u0027s password and accessing their data. The vulnerability\u0027s root cause is a failure to verify that an authenticator is appropriate for the active authentication flow, combined with insecure handling of concurrent session updates.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat build of Keycloak 26.6.8"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-103112"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-103112",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-103112"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-103112",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-103112"
        }
      ],
      "release_date": "2026-11-05T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-06T10:21:57+00:00",
          "details": "Before applying the update, back up your existing installation,\nincluding all applications, configuration files, databases and\ndatabase settings, and so on.",
          "product_ids": [
            "Red Hat build of Keycloak 26.6.8"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:95761"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat build of Keycloak 26.6.8"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "keycloak-services: keycloak-services: Account takeover via authentication race using reset-credentials path"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Robin Marchand"
          ]
        }
      ],
      "cve": "CVE-2026-103884",
      "cwe": {
        "id": "CWE-22",
        "name": "Improper Limitation of a Pathname to a Restricted Directory"
      },
      "discovery_date": "2026-09-30T13:25:36+00:00",
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the X.509 client certificate authenticator of Keycloak. When CRL Distribution Point checking is enabled, the server fails to properly validate the file paths provided in a client certificate. An attacker can provide a specially crafted certificate that causes the server to attempt to read sensitive files from the local system or exhaust memory by loading extremely large files, potentially leading to information disclosure or a system crash.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "keycloak-services: keycloak-services: Path traversal in X.509 CRL Distribution Point allows arbitrary local file read",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "The Red Hat Product Security team has assessed the severity of this vulnerability as Moderate, given that it requires non-default configurations (crl-checking-enabled and crldp-checking-enabled) to be active. Successful exploitation allows an attacker to perform arbitrary local file read attempts, potentially leaking file existence or metadata, and cause a Denial of Service through memory exhaustion. The vulnerabilitys root cause is a lack of path normalization and containment checks on the CRL Distribution Point value provided in X.509 certificates.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat build of Keycloak 26.6.8"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-103884"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-103884",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-103884"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-103884",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-103884"
        }
      ],
      "release_date": "2026-09-30T13:25:36+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-06T10:21:57+00:00",
          "details": "Before applying the update, back up your existing installation,\nincluding all applications, configuration files, databases and\ndatabase settings, and so on.",
          "product_ids": [
            "Red Hat build of Keycloak 26.6.8"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:95761"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat build of Keycloak 26.6.8"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "keycloak-services: keycloak-services: Path traversal in X.509 CRL Distribution Point allows arbitrary local file read"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Ap4sh (Samy Medjahed)",
            "Ethicxz (Eliott Laurie)"
          ]
        }
      ],
      "cve": "CVE-2026-105305",
      "cwe": {
        "id": "CWE-287",
        "name": "Improper Authentication"
      },
      "discovery_date": "2026-10-02T12:19:19+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2545801"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the OIDC implementation of Keycloak, specifically within the Device Authorization Grant flow. This component allows devices with limited input capabilities to obtain security tokens. The issue occurs because the flow fails to check the minimum authentication level required by a client configuration. This allows an attacker who has stolen a user\u0027s password to bypass mandatory multi-factor authentication and gain unauthorized access to the Keycloak Admin REST API.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "keycloak-services: keycloak-services: Device Authorization Grant bypasses per-client minimum.acr.value enforcement",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "The Red Hat Product Security team has assessed the severity of this vulnerability as Important, given that it allows for a bypass of multi-factor authentication (MFA) requirements. Successful exploitation allows an attacker to obtain a valid token and access the Keycloak Admin REST API with the client\u0027s scoped roles, provided they have obtained the user\u0027s primary credentials. The vulnerability\u0027s root cause is the failure of the Device Authorization Grant flow to enforce the per-client minimum.acr.value configuration.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat build of Keycloak 26.6.8"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-105305"
        },
        {
          "category": "external",
          "summary": "RHBZ#2545801",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2545801"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-105305",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-105305"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-105305",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-105305"
        }
      ],
      "release_date": "2026-10-06T06:51:34.524000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-06T10:21:57+00:00",
          "details": "Before applying the update, back up your existing installation,\nincluding all applications, configuration files, databases and\ndatabase settings, and so on.",
          "product_ids": [
            "Red Hat build of Keycloak 26.6.8"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:95761"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat build of Keycloak 26.6.8"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat build of Keycloak 26.6.8"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "keycloak-services: keycloak-services: Device Authorization Grant bypasses per-client minimum.acr.value enforcement"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Paul Bottinelli of Trail of Bits in collaboration with OpenAI"
          ]
        }
      ],
      "cve": "CVE-2026-107121",
      "cwe": {
        "id": "CWE-319",
        "name": "Cleartext Transmission of Sensitive Information"
      },
      "discovery_date": "2026-10-06T16:28:37+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2547296"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the SMTP email configuration handling of the keycloak-services component. When the STARTTLS option is enabled, Keycloak fails to strictly enforce an encrypted connection, allowing it to fall back to unencrypted communication if the encryption request is tampered with. An attacker who can intercept network traffic can exploit this to capture sensitive email credentials and message content in plain text.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "keycloak-services: keycloak-services: SMTP STARTTLS plaintext credential and message downgrade",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "The Red Hat Product Security team has assessed the severity of this vulnerability as Moderate, given that exploitation requires an active Man-in-the-Middle network position. Successful exploitation allows an attacker to capture SMTP credentials and email message bodies in plaintext. The vulnerability\u0027s root cause is the failure to enforce mandatory TLS when the STARTTLS configuration is enabled, allowing a silent fallback to unencrypted communication.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat build of Keycloak 26.6.8"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-107121"
        },
        {
          "category": "external",
          "summary": "RHBZ#2547296",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2547296"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-107121",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-107121"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-107121",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-107121"
        }
      ],
      "release_date": "2026-10-06T16:28:37+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-06T10:21:57+00:00",
          "details": "Before applying the update, back up your existing installation,\nincluding all applications, configuration files, databases and\ndatabase settings, and so on.",
          "product_ids": [
            "Red Hat build of Keycloak 26.6.8"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:95761"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat build of Keycloak 26.6.8"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat build of Keycloak 26.6.8"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "keycloak-services: keycloak-services: SMTP STARTTLS plaintext credential and message downgrade"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Mohammed LACHHAB"
          ]
        }
      ],
      "cve": "CVE-2026-107123",
      "cwe": {
        "id": "CWE-400",
        "name": "Uncontrolled Resource Consumption"
      },
      "discovery_date": "2026-10-06T16:16:56+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2547297"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the SAML XML processing component of Keycloak, an open-source identity and access management solution. The issue occurs when the server parses XML documents containing excessively long dateTime or duration values. Because these strings are not properly validated before processing, the XML parser consumes excessive CPU time. An unauthenticated remote attacker can exploit this by sending specially crafted SAML requests to the server, leading to high CPU utilization and a denial of service for all users.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "keycloak-services: keycloak-services: Unauthenticated CPU denial of service via SAML XML dateTime and duration parsing",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "The Red Hat Product Security team has assessed the severity of this vulnerability as Important, given that it can be exploited by an unauthenticated remote attacker. Successful exploitation allows an attacker to cause a significant denial of service by exhausting CPU resources on the Keycloak server. The vulnerability\u0027s root cause is improper validation of the length of dateTime and duration strings within SAML XML payloads before parsing.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat build of Keycloak 26.6.8"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-107123"
        },
        {
          "category": "external",
          "summary": "RHBZ#2547297",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2547297"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-107123",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-107123"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-107123",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-107123"
        }
      ],
      "release_date": "2026-11-05T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-06T10:21:57+00:00",
          "details": "Before applying the update, back up your existing installation,\nincluding all applications, configuration files, databases and\ndatabase settings, and so on.",
          "product_ids": [
            "Red Hat build of Keycloak 26.6.8"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:95761"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat build of Keycloak 26.6.8"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat build of Keycloak 26.6.8"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "keycloak-services: keycloak-services: Unauthenticated CPU denial of service via SAML XML dateTime and duration parsing"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Adam Korczynski (Ada Logics Ltd) and Anthropic"
          ]
        }
      ],
      "cve": "CVE-2026-107124",
      "cwe": {
        "id": "CWE-384",
        "name": "Session Fixation"
      },
      "discovery_date": "2026-10-06T14:42:31+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2547298"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the OIDC logout endpoint of the keycloak-services component, which handles user session termination in Red Hat Build of Keycloak. The issue occurs because the system sets a session cookie based on an unvalidated token hint before completing security checks. An attacker can use this flaw to fix a session ID in a victim\u0027s browser, allowing them to hijack the victim\u0027s subsequent login and gain full control over their account.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "keycloak-services: keycloak-services: OIDC logout endpoint session fixation via id_token_hint leading to account takeover",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "The Red Hat Product Security team has assessed the severity of this vulnerability as Important, given that it requires the victim to have no active session and be induced to visit a crafted URL within a specific timing window. Successful exploitation allows an attacker to achieve full account takeover of any user in the realm, including administrators. The vulnerability\u0027s root cause is the premature setting of session cookies before token validation and the reuse of authentication session IDs during login.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat build of Keycloak 26.6.8"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-107124"
        },
        {
          "category": "external",
          "summary": "RHBZ#2547298",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2547298"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-107124",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-107124"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-107124",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-107124"
        }
      ],
      "release_date": "2026-11-05T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-06T10:21:57+00:00",
          "details": "Before applying the update, back up your existing installation,\nincluding all applications, configuration files, databases and\ndatabase settings, and so on.",
          "product_ids": [
            "Red Hat build of Keycloak 26.6.8"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:95761"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat build of Keycloak 26.6.8"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat build of Keycloak 26.6.8"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "keycloak-services: keycloak-services: OIDC logout endpoint session fixation via id_token_hint leading to account takeover"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Animesh Roy"
          ]
        }
      ],
      "cve": "CVE-2026-107602",
      "cwe": {
        "id": "CWE-835",
        "name": "Loop with Unreachable Exit Condition"
      },
      "discovery_date": "2026-10-07T12:10:20+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2547937"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the SAML 1.1 XML parsing logic of Keycloak, an open-source identity and access management solution. The issue occurs when the parser encounters unexpected elements within a security token\u0027s key information section, causing the processing thread to enter an infinite loop. An unauthenticated remote attacker could exploit this by sending specially crafted requests, leading to 100% CPU usage and a total denial of service that requires a server restart to resolve.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "keycloak-services: keycloak-services: Unauthenticated CPU exhaustion via SAML 1.1 KeyInfo infinite loop",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "The Red Hat Product Security team has assessed the severity of this vulnerability as Important, given that it can be exploited by an unauthenticated remote attacker under default configurations. Successful exploitation allows an attacker to exhaust server CPU resources and worker threads, leading to a complete denial of service. The vulnerability\u0027s root cause is an improper loop termination condition in the SAML 1.1 XML parser when encountering unhandled child elements.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat build of Keycloak 26.6.8"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-107602"
        },
        {
          "category": "external",
          "summary": "RHBZ#2547937",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2547937"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-107602",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-107602"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-107602",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-107602"
        }
      ],
      "release_date": "2026-11-05T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-06T10:21:57+00:00",
          "details": "Before applying the update, back up your existing installation,\nincluding all applications, configuration files, databases and\ndatabase settings, and so on.",
          "product_ids": [
            "Red Hat build of Keycloak 26.6.8"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:95761"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat build of Keycloak 26.6.8"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat build of Keycloak 26.6.8"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "keycloak-services: keycloak-services: Unauthenticated CPU exhaustion via SAML 1.1 KeyInfo infinite loop"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Peter Su"
          ],
          "organization": "psu512"
        }
      ],
      "cve": "CVE-2026-107623",
      "cwe": {
        "id": "CWE-862",
        "name": "Missing Authorization"
      },
      "discovery_date": "2026-10-07T12:39:27+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2547957"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the OIDC Dynamic Client Registration (DCR) component of Keycloak. A bug in the response serialization causes the backchannel logout offline token revocation setting to be omitted from responses. When a client performs a standard update, this missing information causes the setting to be silently disabled. As a result, offline tokens may remain valid even after a user session is terminated via backchannel logout.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "keycloak-services: keycloak-services: OIDC DCR read-modify-write silently disables offline token revocation",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "The Red Hat Product Security team has assessed the severity of this vulnerability as Moderate, given that exploitation requires the attacker to have client management privileges. Successful exploitation allows an attacker to silently disable security settings that ensure offline tokens are revoked during backchannel logout, leading to persistent access after session termination. The vulnerability\u0027s root cause is a serialization bug in the OIDC Dynamic Client Registration response handler.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat build of Keycloak 26.6.8"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-107623"
        },
        {
          "category": "external",
          "summary": "RHBZ#2547957",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2547957"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-107623",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-107623"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-107623",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-107623"
        }
      ],
      "release_date": "2026-10-07T12:39:27+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-06T10:21:57+00:00",
          "details": "Before applying the update, back up your existing installation,\nincluding all applications, configuration files, databases and\ndatabase settings, and so on.",
          "product_ids": [
            "Red Hat build of Keycloak 26.6.8"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:95761"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat build of Keycloak 26.6.8"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat build of Keycloak 26.6.8"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "keycloak-services: keycloak-services: OIDC DCR read-modify-write silently disables offline token revocation"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Mohammed LACHHAB"
          ]
        }
      ],
      "cve": "CVE-2026-107889",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation"
      },
      "discovery_date": "2026-10-08T15:38:13+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2548355"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the login theme rendering component of Keycloak. The issue occurs because the security filter responsible for cleaning user input can be bypassed, allowing a realm administrator to store malicious scripts in display fields. This could result in unauthorized JavaScript execution in the browsers of users visiting the login page, potentially leading to data exposure or session interference.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "keycloak-services: keycloak-services: Stored XSS on login page via kcSanitize bypass",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "The Red Hat Product Security team has assessed the severity of this vulnerability as Moderate, given that exploitation requires the attacker to possess administrative privileges (manage-realm permission). Successful exploitation allows an attacker to execute arbitrary JavaScript in the browser of users visiting the affected realm\u0027s login page. The vulnerability\u0027s root cause is an improper neutralization of input during web page generation, where a post-processing step inadvertently re-activates malicious payloads previously neutralized by the sanitization filter.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat build of Keycloak 26.6.8"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-107889"
        },
        {
          "category": "external",
          "summary": "RHBZ#2548355",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2548355"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-107889",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-107889"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-107889",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-107889"
        }
      ],
      "release_date": "2026-10-08T15:38:13+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-06T10:21:57+00:00",
          "details": "Before applying the update, back up your existing installation,\nincluding all applications, configuration files, databases and\ndatabase settings, and so on.",
          "product_ids": [
            "Red Hat build of Keycloak 26.6.8"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:95761"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat build of Keycloak 26.6.8"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "HIGH",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat build of Keycloak 26.6.8"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "keycloak-services: keycloak-services: Stored XSS on login page via kcSanitize bypass"
    },
    {
      "cve": "CVE-2026-109081",
      "cwe": {
        "id": "CWE-862",
        "name": "Missing Authorization"
      },
      "discovery_date": "2026-10-09T18:28:55+00:00",
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Keycloak. The Dynamic Client Registration (DCR) endpoint does not properly validate authorization when processing the deprecated defaultRoles field. An authenticated attacker with client creation privileges or an Initial Access Token (IAT) can inject excessive roles into the realm\u0027s default roles configuration. This causes clients across the realm to generate bloated access tokens, resulting in performance and memory degradation that can lead to a Denial of Service (DoS).",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "keycloak-services: keycloak-services: Injection of roles into realm default-roles via DCR endpoint",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "The Red Hat Product Security team has rated this vulnerability as Moderate severity. An attacker needs high privileges to exploit it: either the create-client realm-management role or an Initial Access Token issued by an administrator. The flaw exists because the Dynamic Client Registration endpoint doesn\u0027t properly check authorization when it processes the deprecated defaultRoles field. This lets an attacker add a large number of roles to the realm\u0027s default-roles composite. As a result, every client with full scope allowed (the default setting) gets bloated access tokens, which causes performance and memory problems across the realm. The main impact is on availability. This flaw doesn\u0027t directly give anyone unauthorized access to protected resources.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat build of Keycloak 26.6.8"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-109081"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-109081",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-109081"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-109081",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-109081"
        }
      ],
      "release_date": "2026-11-05T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-06T10:21:57+00:00",
          "details": "Before applying the update, back up your existing installation,\nincluding all applications, configuration files, databases and\ndatabase settings, and so on.",
          "product_ids": [
            "Red Hat build of Keycloak 26.6.8"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:95761"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat build of Keycloak 26.6.8"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "HIGH",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat build of Keycloak 26.6.8"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "keycloak-services: keycloak-services: Injection of roles into realm default-roles via DCR endpoint"
    },
    {
      "cve": "CVE-2026-110879",
      "cwe": {
        "id": "CWE-1035",
        "name": "CWE-1035"
      },
      "discovery_date": "2026-10-22T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2558783"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "PolymorphicTypeValidator bypass via generic type arguments and array element types in jackson-databind allows arbitrary class instantiation (incomplete fix for CVE-2026-54512) [CVE-2026-110879]",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "jackson-databind: com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: Jackson-databind: PolymorphicTypeValidator bypass via generic type arguments and array element types in jackson-databind allows arbitrary class instantiation (incomplete fix for CV",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat has evaluated this vulnerability as an Important severity flaw because successful remote exploitation can result in arbitrary class instantiation and code execution, though it requires specific non-default deserialization patterns. For an application to be vulnerable, polymorphic type validation must be configured to process untrusted input with class-name identifiers, and exploitable gadget classes must exist on the classpath. In standard Red Hat product configurations, permissive class-name polymorphism is not enabled by default on external interfaces, significantly limiting exposure in typical production environments.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat build of Keycloak 26.6.8"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-110879"
        },
        {
          "category": "external",
          "summary": "RHBZ#2558783",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2558783"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-110879",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-110879"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-110879",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110879"
        }
      ],
      "release_date": "2026-10-20T22:44:36+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-06T10:21:57+00:00",
          "details": "Before applying the update, back up your existing installation,\nincluding all applications, configuration files, databases and\ndatabase settings, and so on.",
          "product_ids": [
            "Red Hat build of Keycloak 26.6.8"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:95761"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat build of Keycloak 26.6.8"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat build of Keycloak 26.6.8"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "jackson-databind: com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: Jackson-databind: PolymorphicTypeValidator bypass via generic type arguments and array element types in jackson-databind allows arbitrary class instantiation (incomplete fix for CV"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Animesh Roy"
          ]
        }
      ],
      "cve": "CVE-2026-110931",
      "cwe": {
        "id": "CWE-835",
        "name": "Loop with Unreachable Exit Condition"
      },
      "discovery_date": "2026-10-14T12:56:48+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2553047"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the SAML 1.1 assertion parser of Keycloak, a tool used for identity and access management. The issue occurs when the parser handles a specific element called AuthorityBinding within an authentication statement. Due to an incomplete fix for a previous vulnerability, the parser can enter an infinite loop that consumes all available memory, causing the entire Keycloak service to crash and become unavailable to users.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "keycloak-services: keycloak-services: Unauthenticated JVM termination via SAML 1.1 AuthorityBinding parsing loop",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "The Red Hat Product Security team has assessed the severity of this vulnerability as Important, given that it can be exploited by a remote, unauthenticated attacker with a single request. Successful exploitation allows an attacker to cause a complete Denial of Service by terminating the JVM via memory exhaustion. The vulnerability\u0027s root cause is an infinite loop in the SAML 1.1 AuthorityBinding parsing logic, which was missed during the remediation of CVE-2026-7307.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat build of Keycloak 26.6.8"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-110931"
        },
        {
          "category": "external",
          "summary": "RHBZ#2553047",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2553047"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-110931",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-110931"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-110931",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110931"
        }
      ],
      "release_date": "2026-11-05T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-06T10:21:57+00:00",
          "details": "Before applying the update, back up your existing installation,\nincluding all applications, configuration files, databases and\ndatabase settings, and so on.",
          "product_ids": [
            "Red Hat build of Keycloak 26.6.8"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:95761"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat build of Keycloak 26.6.8"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat build of Keycloak 26.6.8"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "keycloak-services: keycloak-services: Unauthenticated JVM termination via SAML 1.1 AuthorityBinding parsing loop"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Adel Assakaf"
          ],
          "organization": "Oteria"
        }
      ],
      "cve": "CVE-2026-110932",
      "cwe": {
        "id": "CWE-400",
        "name": "Uncontrolled Resource Consumption"
      },
      "discovery_date": "2026-10-13T21:12:32+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2553049"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the theme resource endpoint of Keycloak, an open-source identity and access management solution. The issue occurs because the server fails to validate theme names before using them as keys for an on-disk gzip cache. An unauthenticated attacker can exploit this by sending many requests with unique, fabricated theme names, leading to persistent disk space exhaustion that survives server restarts and causes service disruptions.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "keycloak-services: keycloak-services: Unauthenticated persistent disk exhaustion via theme gzip cache",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "The Red Hat Product Security team has assessed the severity of this vulnerability as Important, given that it can be exploited by an unauthenticated remote attacker to cause a persistent Denial of Service. Successful exploitation allows an attacker to exhaust the servers disk space, leading to service failure and preventing legitimate users from accessing the application. The vulnerabilitys root cause is the lack of validation for theme names used as on-disk cache keys.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat build of Keycloak 26.6.8"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-110932"
        },
        {
          "category": "external",
          "summary": "RHBZ#2553049",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2553049"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-110932",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-110932"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-110932",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110932"
        }
      ],
      "release_date": "2025-11-05T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-06T10:21:57+00:00",
          "details": "Before applying the update, back up your existing installation,\nincluding all applications, configuration files, databases and\ndatabase settings, and so on.",
          "product_ids": [
            "Red Hat build of Keycloak 26.6.8"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:95761"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat build of Keycloak 26.6.8"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat build of Keycloak 26.6.8"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "keycloak-services: keycloak-services: Unauthenticated persistent disk exhaustion via theme gzip cache"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "LHeiakim"
          ]
        }
      ],
      "cve": "CVE-2026-112208",
      "cwe": {
        "id": "CWE-305",
        "name": "Authentication Bypass by Primary Weakness"
      },
      "discovery_date": "2026-10-16T14:58:44+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2555473"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Organization identity-first login flow of the Keycloak authentication server. Keycloak is an open-source identity and access management solution used to secure modern applications and services. The issue occurs when an attacker who belongs to multiple organizations initiates a login and then switches to a registration or password reset path. During this process, a flag indicating a successful login is not properly cleared when the user is removed from the session. An attacker can then provide a victim\u0027s username, and the system incorrectly treats the stale flag as proof of the victim\u0027s identity. This allows the attacker to bypass authentication and gain full access to the victim\u0027s account and connected applications.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "keycloak-services: keycloak-services: Account takeover via stale SSO_AUTH note in Organization identity-first login",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "The Red Hat Product Security team has assessed the severity of this vulnerability as Important, given that it requires the Organization feature to be enabled and the attacker to have membership in at least two organizations. Successful exploitation allows an attacker to achieve full account takeover and session hijacking of a victim user. The vulnerability\u0027s root cause is the improper management of internal authentication state flags during login flow transitions.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat build of Keycloak 26.6.8"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-112208"
        },
        {
          "category": "external",
          "summary": "RHBZ#2555473",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2555473"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-112208",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-112208"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-112208",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-112208"
        }
      ],
      "release_date": "2026-11-05T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-06T10:21:57+00:00",
          "details": "Before applying the update, back up your existing installation,\nincluding all applications, configuration files, databases and\ndatabase settings, and so on.",
          "product_ids": [
            "Red Hat build of Keycloak 26.6.8"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:95761"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat build of Keycloak 26.6.8"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat build of Keycloak 26.6.8"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "keycloak-services: keycloak-services: Account takeover via stale SSO_AUTH note in Organization identity-first login"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "0xNayel"
          ],
          "organization": "YesWeHack Bug Bounty Program"
        }
      ],
      "cve": "CVE-2026-114232",
      "cwe": {
        "id": "CWE-862",
        "name": "Missing Authorization"
      },
      "discovery_date": "2026-10-19T12:07:08+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2558074"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the UserManagedPermissionService of the Keycloak authorization server. The UMA Protection API, which manages user permissions, fails to validate the resourceType field when a user creates a new policy. This allows an attacker to create a policy that applies to resources owned by other users, potentially leading to unauthorized access or modification of sensitive data across the entire realm.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "keycloak-services: keycloak-services: UMA Protection API resourceType field not validated \u2014 cross-owner resource access",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "The Red Hat Product Security team has assessed the severity of this vulnerability as Important, given that an authenticated user can bypass resource ownership boundaries. Successful exploitation allows an attacker to gain unauthorized access to and potentially modify resources belonging to other users within the same realm. The vulnerabilitys root cause is a lack of validation for the resourceType field in the UMA Protection API during policy creation.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat build of Keycloak 26.6.8"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-114232"
        },
        {
          "category": "external",
          "summary": "RHBZ#2558074",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2558074"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-114232",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-114232"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-114232",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-114232"
        }
      ],
      "release_date": "2026-11-05T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-06T10:21:57+00:00",
          "details": "Before applying the update, back up your existing installation,\nincluding all applications, configuration files, databases and\ndatabase settings, and so on.",
          "product_ids": [
            "Red Hat build of Keycloak 26.6.8"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:95761"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat build of Keycloak 26.6.8"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat build of Keycloak 26.6.8"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "keycloak-services: keycloak-services: UMA Protection API resourceType field not validated \u2014 cross-owner resource access"
    }
  ]
}