Red hat single sign-on 7
This hub aggregates every CVE we track for Red hat single sign-on 7, a product in the security products space. Use it to gauge the current risk picture and drill into individual advisories.
172
CVEs tracked
2
Critical
61
High
0
In CISA KEV
Severity distribution
MEDIUM93HIGH61LOW16CRITICAL2
Monthly trend
2
7
0
2
2
2
1
0
0
1
0
1
0
1
1
6
2
9
0
0
2
27
28
44
2024-102026-09
Latest CVEs
The 15 most recently published vulnerabilities affecting Red hat single sign-on 7.
- CVE-2026-96445Keycloak-services: keycloak-services: conditional otp skip-header policy evaluated against untrusted proxy headers6.8
- CVE-2026-96446Keycloak-services: keycloak-services: par single-use bypass via prompt=none silent authentication path4.2
- CVE-2026-95503Keycloak-services: keycloak-services: potential kdc spoofing bypass when kerberos password authentication is enabled6.8
- CVE-2026-94218Keycloak-services: keycloak-services: 2fa setup enforcement bypass via authentication session restart endpoint3.1
- CVE-2026-94217Keycloak-services: keycloak-services: uma scope merge across resource owners via resource name collision3.5
- CVE-2026-94215Keycloak-services: keycloak-services: cross-realm client read/write via request-level cache missing realm ownership check5.5
- CVE-2026-94213Keycloak-services: keycloak-services: authorization services policy evaluation endpoint leaks user identity4.9
- CVE-2026-94001Keycloak-services: keycloak-services: admin credential delete bypasses denied reset-password permission6.5
- CVE-2026-94000Keycloak-services: keycloak-services: delegated admin with manage-users can escalate to realm-admin via group membership6.6
- CVE-2026-93999Keycloak-services: keycloak-services: token refresh continues issuing tokens for disabled audience clients4.2
- CVE-2026-93562Io.netty/netty-codec-http: netty: incomplete validation of malformed transfer-encoding allows http request smuggling6.5
- CVE-2026-93574Io.netty/netty-codec-http: netty: http request smuggling via post-digit whitespace in chunk-size parsing6.5
- CVE-2026-93579Io.netty/netty-codec-http2: netty: http/2 header field values are not validated by default (cr/lf/nul passthrough)6.5
- CVE-2026-93573Io.netty/netty-codec-http: netty split transfer-encoding fields bypass final-chunked validation and enable request smuggling6.5
- CVE-2026-93568Io.netty/netty-codec-http2: io.netty/netty-codec-http3: netty: http/2 and http/3 extended connect requests are downgraded as regular connect requests7.5
Product normalization is registry-driven with AI assist and human review. How it works