Red hat build of keycloak

This hub aggregates every CVE we track for Red hat build of keycloak, a product in the web cms plugins space. Use it to gauge the current risk picture and drill into individual advisories.

Severity distribution

Monthly trend

The 15 most recently published vulnerabilities affecting Red hat build of keycloak.

• CVE-2026-96445Keycloak-services: keycloak-services: conditional otp skip-header policy evaluated against untrusted proxy headers6.8Sep 23, 2026
• CVE-2026-96446Keycloak-services: keycloak-services: par single-use bypass via prompt=none silent authentication path4.2Sep 23, 2026
• CVE-2026-95503Keycloak-services: keycloak-services: potential kdc spoofing bypass when kerberos password authentication is enabled6.8Sep 22, 2026
• CVE-2026-94218Keycloak-services: keycloak-services: 2fa setup enforcement bypass via authentication session restart endpoint3.1Sep 21, 2026
• CVE-2026-94217Keycloak-services: keycloak-services: uma scope merge across resource owners via resource name collision3.5Sep 21, 2026
• CVE-2026-94215Keycloak-services: keycloak-services: cross-realm client read/write via request-level cache missing realm ownership check5.5Sep 21, 2026
• CVE-2026-94213Keycloak-services: keycloak-services: authorization services policy evaluation endpoint leaks user identity4.9Sep 21, 2026
• CVE-2026-94001Keycloak-services: keycloak-services: admin credential delete bypasses denied reset-password permission6.5Sep 19, 2026
• CVE-2026-94000Keycloak-services: keycloak-services: delegated admin with manage-users can escalate to realm-admin via group membership6.6Sep 19, 2026
• CVE-2026-93999Keycloak-services: keycloak-services: token refresh continues issuing tokens for disabled audience clients4.2Sep 19, 2026
• CVE-2026-93562Io.netty/netty-codec-http: netty: incomplete validation of malformed transfer-encoding allows http request smuggling6.5Sep 18, 2026
• CVE-2026-93574Io.netty/netty-codec-http: netty: http request smuggling via post-digit whitespace in chunk-size parsing6.5Sep 18, 2026
• CVE-2026-93432Io.quarkus.qute:quarkus-core: cross-site scripting (xss) and json injection via qute {#eval} section in quarkus6.1Sep 18, 2026
• CVE-2026-93579Io.netty/netty-codec-http2: netty: http/2 header field values are not validated by default (cr/lf/nul passthrough)6.5Sep 18, 2026
• CVE-2026-93573Io.netty/netty-codec-http: netty split transfer-encoding fields bypass final-chunked validation and enable request smuggling6.5Sep 18, 2026