Technology · Red Hat
Red Hat Keycloak vulnerabilities
Updated . Rebuilt every hour.
Junglewise Threat Intelligence has tracked 102 vulnerabilities in Red Hat Keycloak: 8 in the last 7 days and 49 in the last 90 days, 4 of them critical and 0 exploited in the wild. The most recent, CVE-2026-116468, was published on 11 November 2026. 28 vulnerabilities in the last four weeks, up 56% on the four before (18). 2 critical against 0.
- Last 7 days
- 8
- Last 90 days
- 49
- Critical, all time
- 4
- Exploited in the wild
- 0
About Red Hat Keycloak
Open-source identity and access management server.
Latest Red Hat Keycloak vulnerabilities
- CVE-2026-116468: Red Hat Keycloak missing authorization check in group reparentingmediumCVSS 6.6
- CVE-2026-120984: Keycloak server arbitrary code execution in client authorizationcriticalCVSS 9.1
- CVE-2026-9797: Keycloak privilege escalation via client authentication manipulationmediumCVSS 6.5
- CVE-2026-97367: Keycloak Account REST API session manipulationmediumCVSS 6.4
- CVE-2026-96460: Keycloak token exchange lifetime bypass in Standard Token Exchange V2mediumCVSS 5.4
- CVE-2026-92856: Keycloak SAML broker ProxyRestriction bypassmediumCVSS 4.9
- CVE-2026-109081: Keycloak authorization bypass in Dynamic Client RegistrationmediumCVSS 6.8
- CVE-2026-107124: Red Hat Build of Keycloak OIDC logout session fixationmediumCVSS 6.4
- CVE-2026-97847: Keycloak privilege escalation via hardcoded-claim mappershighCVSS 7.1
- CVE-2026-97175: Keycloak idp-auto-link authenticator account takeoverhighCVSS 8.8
- CVE-2026-97174: Keycloak CIBA parameter injection allows token spoofingmediumCVSS 6.8
- CVE-2026-96453: Keycloak Admin CLI kcadm certificate validation bypasshighCVSS 8
- CVE-2026-93998: Keycloak SAML adapter issuer validation bypasshighCVSS 7.4
- CVE-2026-92857: Keycloak Dynamic Client Registration validation bypasshighCVSS 8.1
- CVE-2026-92855: Keycloak SAML broker authentication bypass in holder-of-key assertion verificationhighCVSS 7.4
- CVE-2026-114232: Keycloak authorization server cross-owner resource access in UMA Protection APIhighCVSS 8.1
- CVE-2026-112208: Keycloak authentication bypass in organization identity-first loginhighCVSS 8.1
- CVE-2026-110932: Keycloak theme resource disk exhaustionhighCVSS 7.5
- CVE-2026-110931: Keycloak SAML 1.1 assertion parser infinite loop denial of servicehighCVSS 7.5
- CVE-2026-107123: Keycloak SAML XML denial of service via unvalidated dateTime parsinghighCVSS 7.5
- CVE-2026-117691: Keycloak SAML signature bypass via percent-encoded parameterscriticalCVSS 9.1
- CVE-2026-118959: Keycloak required action provider authentication bypassmediumCVSS 5.4
- CVE-2026-118947: Keycloak authorization bypass in UMA resource registrationmediumCVSS 4.3
- CVE-2026-118425: Keycloak secure-redirect-uris-enforcer open redirect via DNS resolutionmediumCVSS 6.8
- CVE-2026-118030: Keycloak HOTP race condition allows OTP code reusemediumCVSS 4.2
Most severe Red Hat Keycloak vulnerabilities
Exploited in the wild first, then by severity and CVSS score.
- CVE-2026-33228: WebReflection flatted prototype pollution in parse functioncriticalCVSS 9.8EPSS 1.0%
- CVE-2026-18963: Keycloak unauthenticated account takeover via reset-credentials bypasscriticalCVSS 9.1EPSS 6.4%
- CVE-2026-120984: Keycloak server arbitrary code execution in client authorizationcriticalCVSS 9.1
- CVE-2026-117691: Keycloak SAML signature bypass via percent-encoded parameterscriticalCVSS 9.1
- CVE-2026-1486: Keycloak improper security check for disabled Identity ProvidershighCVSS 8.8EPSS 0.5%
- CVE-2026-97175: Keycloak idp-auto-link authenticator account takeoverhighCVSS 8.8
- CVE-2026-7504: Red Hat Keycloak open redirect via URL validation bypasshighCVSS 8.1EPSS 0.5%
- CVE-2026-3009: Keycloak authentication bypass via disabled Identity ProviderhighCVSS 8.1EPSS 0.5%
- CVE-2026-11800: Keycloak JWT algorithm confusion in JWT Authorization Grant flowhighCVSS 8.1EPSS 0.3%
- CVE-2026-92857: Keycloak Dynamic Client Registration validation bypasshighCVSS 8.1
Vulnerabilities per week
28 vulnerabilities in the last four weeks, up 56% on the four before (18). 2 critical against 0. The last 13 weeks, by the week each vulnerability was published.
| Week of | Bar | Vulns | Critical |
|---|---|---|---|
| 17 Aug 2026 | 1 | 1 | |
| 24 Aug 2026 | 1 | 0 | |
| 31 Aug 2026 | 0 | 0 | |
| 7 Sep 2026 | 0 | 0 | |
| 14 Sep 2026 | 1 | 0 | |
| 21 Sep 2026 | 9 | 0 | |
| 28 Sep 2026 | 1 | 0 | |
| 5 Oct 2026 | 7 | 0 | |
| 12 Oct 2026 | 0 | 0 | |
| 19 Oct 2026 | 1 | 0 | |
| 26 Oct 2026 | 7 | 0 | |
| 2 Nov 2026 | 20 | 2 | |
| 9 Nov 2026 | 1 | 0 |
Embed a badge
A live badge for a README, a status page or an internal wiki: how many Red Hat Keycloak vulnerabilities were published in the last 7 days and how many of them are critical, refreshed hourly.
[](https://junglewise.ai/threats/technologies/red-hat-keycloak)<a href="https://junglewise.ai/threats/technologies/red-hat-keycloak"><img src="https://junglewise.ai/threats/technologies/red-hat-keycloak/badge.svg" alt="Red Hat Keycloak vulnerabilities" /></a>How this is built
Junglewise Threat Intelligence collects vulnerabilities from NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories, and matches each one to the technologies and vendors it affects. Dates are the date a vulnerability was published, in UTC.
The pages are rebuilt from the database every hour. Frozen weekly and monthly reports never change once published, so they can be cited.
Use this data
The same data is at https://junglewise.ai/threats/technologies/red-hat-keycloak.json, and this page as text at https://junglewise.ai/threats/technologies/red-hat-keycloak.md, for scripts and language models. It is free to reuse under CC BY 4.0 with a link back to this page.
Cite as: Junglewise Threat Intelligence, "Red Hat Keycloak vulnerabilities", https://junglewise.ai/threats/technologies/red-hat-keycloak, 13 November 2026.