# Red Hat Keycloak vulnerabilities Source: https://junglewise.ai/threats/technologies/red-hat-keycloak Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 13 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/red-hat-keycloak.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 102 vulnerabilities in Red Hat Keycloak: 8 in the last 7 days and 49 in the last 90 days, 4 of them critical and 0 exploited in the wild. The most recent, CVE-2026-116468, was published on 11 November 2026. 28 vulnerabilities in the last four weeks, up 56% on the four before (18). 2 critical against 0. ## Counts - Last 7 days: 8 - Last 30 days: 29 - Last 90 days: 49 - All time: 102 (4 critical, 0 exploited in the wild) ## About Red Hat Keycloak Open-source identity and access management server. ## Latest Red Hat Keycloak vulnerabilities - [CVE-2026-116468: Red Hat Keycloak missing authorization check in group reparenting](https://junglewise.ai/threats/cve-2026-116468-a-flaw-was-found-in-the-group-move-and-organization-group) (medium, CVSS 6.6, published 11 Nov 2026) - [CVE-2026-120984: Keycloak server arbitrary code execution in client authorization](https://junglewise.ai/threats/cve-2026-120984-a-flaw-was-found-in-the-keycloak-server-s-client-management) (critical, CVSS 9.1, published 7 Nov 2026) - [CVE-2026-9797: Keycloak privilege escalation via client authentication manipulation](https://junglewise.ai/threats/cve-2026-9797-a-flaw-was-found-in-keycloak-s-administrative-services-org) (medium, CVSS 6.5, published 6 Nov 2026) - [CVE-2026-97367: Keycloak Account REST API session manipulation](https://junglewise.ai/threats/cve-2026-97367-a-flaw-was-found-in-the-keycloak-account-rest-api-where-it) (medium, CVSS 6.4, published 6 Nov 2026) - [CVE-2026-96460: Keycloak token exchange lifetime bypass in Standard Token Exchange V2](https://junglewise.ai/threats/cve-2026-96460-a-flaw-was-found-in-the-token-exchange-mechanism-of-keycloak-when) (medium, CVSS 5.4, published 6 Nov 2026) - [CVE-2026-92856: Keycloak SAML broker ProxyRestriction bypass](https://junglewise.ai/threats/cve-2026-92856-a-flaw-was-found-in-the-saml-brokering-component-of-keycloak-an) (medium, CVSS 4.9, published 6 Nov 2026) - [CVE-2026-109081: Keycloak authorization bypass in Dynamic Client Registration](https://junglewise.ai/threats/cve-2026-109081-a-flaw-was-found-in-keycloak-the-dynamic-client-registration-dcr) (medium, CVSS 6.8, published 6 Nov 2026) - [CVE-2026-107124: Red Hat Build of Keycloak OIDC logout session fixation](https://junglewise.ai/threats/cve-2026-107124-a-flaw-was-found-in-the-oidc-logout-endpoint-of-the-keycloak) (medium, CVSS 6.4, published 6 Nov 2026) - [CVE-2026-97847: Keycloak privilege escalation via hardcoded-claim mappers](https://junglewise.ai/threats/cve-2026-97847-a-flaw-was-found-in-the-protocol-mapper-and-identity-resolution) (high, CVSS 7.1, published 5 Nov 2026) - [CVE-2026-97175: Keycloak idp-auto-link authenticator account takeover](https://junglewise.ai/threats/cve-2026-97175-a-flaw-was-found-in-the-idp-auto-link-authenticator-of-the) (high, CVSS 8.8, published 5 Nov 2026) - [CVE-2026-97174: Keycloak CIBA parameter injection allows token spoofing](https://junglewise.ai/threats/cve-2026-97174-a-flaw-was-found-in-the-client-initiated-backchannel) (medium, CVSS 6.8, published 5 Nov 2026) - [CVE-2026-96453: Keycloak Admin CLI kcadm certificate validation bypass](https://junglewise.ai/threats/cve-2026-96453-a-flaw-was-found-in-the-keycloak-admin-cli-kcadm-tool-which-is) (high, CVSS 8, published 5 Nov 2026) - [CVE-2026-93998: Keycloak SAML adapter issuer validation bypass](https://junglewise.ai/threats/cve-2026-93998-a-flaw-was-found-in-the-saml-adapter-component-of-keycloak-which) (high, CVSS 7.4, published 5 Nov 2026) - [CVE-2026-92857: Keycloak Dynamic Client Registration validation bypass](https://junglewise.ai/threats/cve-2026-92857-keycloak-provides-a-dynamic-client-registration-feature-that) (high, CVSS 8.1, published 5 Nov 2026) - [CVE-2026-92855: Keycloak SAML broker authentication bypass in holder-of-key assertion verification](https://junglewise.ai/threats/cve-2026-92855-a-flaw-was-found-in-the-saml-identity-broker-component-of) (high, CVSS 7.4, published 5 Nov 2026) - [CVE-2026-114232: Keycloak authorization server cross-owner resource access in UMA Protection API](https://junglewise.ai/threats/cve-2026-114232-a-flaw-was-found-in-the-usermanagedpermissionservice-of-the) (high, CVSS 8.1, published 5 Nov 2026) - [CVE-2026-112208: Keycloak authentication bypass in organization identity-first login](https://junglewise.ai/threats/cve-2026-112208-a-flaw-was-found-in-the-organization-identity-first-login-flow) (high, CVSS 8.1, published 5 Nov 2026) - [CVE-2026-110932: Keycloak theme resource disk exhaustion](https://junglewise.ai/threats/cve-2026-110932-a-flaw-was-found-in-the-theme-resource-endpoint-of-keycloak-an) (high, CVSS 7.5, published 5 Nov 2026) - [CVE-2026-110931: Keycloak SAML 1.1 assertion parser infinite loop denial of service](https://junglewise.ai/threats/cve-2026-110931-a-flaw-was-found-in-the-saml-1-1-assertion-parser-of-keycloak-a) (high, CVSS 7.5, published 5 Nov 2026) - [CVE-2026-107123: Keycloak SAML XML denial of service via unvalidated dateTime parsing](https://junglewise.ai/threats/cve-2026-107123-a-flaw-was-found-in-the-saml-xml-processing-component-of) (high, CVSS 7.5, published 5 Nov 2026) - [CVE-2026-117691: Keycloak SAML signature bypass via percent-encoded parameters](https://junglewise.ai/threats/cve-2026-117691-a-flaw-was-found-in-the-saml-http-redirect-binding) (critical, CVSS 9.1, published 5 Nov 2026) - [CVE-2026-118959: Keycloak required action provider authentication bypass](https://junglewise.ai/threats/cve-2026-118959-a-flaw-was-found-in-the-required-action-provider-mechanism-of) (medium, CVSS 5.4, published 30 Oct 2026) - [CVE-2026-118947: Keycloak authorization bypass in UMA resource registration](https://junglewise.ai/threats/cve-2026-118947-a-flaw-was-found-in-the-uma-resource-registration-endpoint-of) (medium, CVSS 4.3, published 30 Oct 2026) - [CVE-2026-118425: Keycloak secure-redirect-uris-enforcer open redirect via DNS resolution](https://junglewise.ai/threats/cve-2026-118425-a-flaw-was-found-in-the-secure-redirect-uris-enforcer-client) (medium, CVSS 6.8, published 29 Oct 2026) - [CVE-2026-118030: Keycloak HOTP race condition allows OTP code reuse](https://junglewise.ai/threats/cve-2026-118030-a-flaw-was-found-in-the-hotp-authentication-mechanism-of-the) (medium, CVSS 4.2, published 29 Oct 2026) ## Most severe Red Hat Keycloak vulnerabilities - [CVE-2026-33228: WebReflection flatted prototype pollution in parse function](https://junglewise.ai/threats/cve-2026-33228-webreflection-flatted-prototype-pollution-in-parse-function) (critical, CVSS 9.8, published 20 Mar 2026) - [CVE-2026-18963: Keycloak unauthenticated account takeover via reset-credentials bypass](https://junglewise.ai/threats/cve-2026-18963-siemens-industrial-edge-management-authentication-bypass-in) (critical, CVSS 9.1, published 18 Aug 2026) - [CVE-2026-120984: Keycloak server arbitrary code execution in client authorization](https://junglewise.ai/threats/cve-2026-120984-a-flaw-was-found-in-the-keycloak-server-s-client-management) (critical, CVSS 9.1, published 7 Nov 2026) - [CVE-2026-117691: Keycloak SAML signature bypass via percent-encoded parameters](https://junglewise.ai/threats/cve-2026-117691-a-flaw-was-found-in-the-saml-http-redirect-binding) (critical, CVSS 9.1, published 5 Nov 2026) - [CVE-2026-1486: Keycloak improper security check for disabled Identity Providers](https://junglewise.ai/threats/cve-2026-1486-keycloak-improper-security-check-for-disabled-identity-providers) (high, CVSS 8.8, published 9 Feb 2026) - [CVE-2026-97175: Keycloak idp-auto-link authenticator account takeover](https://junglewise.ai/threats/cve-2026-97175-a-flaw-was-found-in-the-idp-auto-link-authenticator-of-the) (high, CVSS 8.8, published 5 Nov 2026) - [CVE-2026-7504: Red Hat Keycloak open redirect via URL validation bypass](https://junglewise.ai/threats/cve-2026-7504-red-hat-keycloak-open-redirect-via-url-validation-bypass) (high, CVSS 8.1, published 19 May 2026) - [CVE-2026-3009: Keycloak authentication bypass via disabled Identity Provider](https://junglewise.ai/threats/cve-2026-3009-keycloak-authentication-bypass-via-disabled-identity-provider) (high, CVSS 8.1, published 5 Mar 2026) - [CVE-2026-11800: Keycloak JWT algorithm confusion in JWT Authorization Grant flow](https://junglewise.ai/threats/cve-2026-11800-keycloak-jwt-algorithm-confusion-in-jwt-authorization-grant-flow) (high, CVSS 8.1, published 25 Jun 2026) - [CVE-2026-92857: Keycloak Dynamic Client Registration validation bypass](https://junglewise.ai/threats/cve-2026-92857-keycloak-provides-a-dynamic-client-registration-feature-that) (high, CVSS 8.1, published 5 Nov 2026) ## Vulnerabilities per week 28 vulnerabilities in the last four weeks, up 56% on the four before (18). 2 critical against 0. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 1 | 1 | 0 | | 24 Aug 2026 | 1 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 1 | 0 | 0 | | 21 Sep 2026 | 9 | 0 | 0 | | 28 Sep 2026 | 1 | 0 | 0 | | 5 Oct 2026 | 7 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 1 | 0 | 0 | | 26 Oct 2026 | 7 | 0 | 0 | | 2 Nov 2026 | 20 | 2 | 0 | | 9 Nov 2026 | 1 | 0 | 0 | ## Other Red Hat technologies - [Red Hat Enterprise Linux 9](https://junglewise.ai/threats/technologies/enterprise-linux-9): 146 vulnerabilities - [Red Hat Enterprise Linux 10](https://junglewise.ai/threats/technologies/enterprise-linux-10): 140 vulnerabilities - [Red Hat Enterprise Linux 8](https://junglewise.ai/threats/technologies/enterprise-linux-8): 132 vulnerabilities - [Red Hat Enterprise Linux 7](https://junglewise.ai/threats/technologies/enterprise-linux-7): 68 vulnerabilities - [Red Hat Enterprise Linux 6](https://junglewise.ai/threats/technologies/enterprise-linux-6): 56 vulnerabilities - [Red Hat Build of Keycloak](https://junglewise.ai/threats/technologies/red-hat-build-of-keycloak): 55 vulnerabilities - [Red Hat Enterprise Linux AppStream](https://junglewise.ai/threats/technologies/enterprise-linux-appstream): 46 vulnerabilities - [Red Hat Ansible Automation Platform](https://junglewise.ai/threats/technologies/ansible-automation-platform-2): 44 vulnerabilities - [Red Hat OpenShift Container Platform 4](https://junglewise.ai/threats/technologies/openshift-container-platform-4): 36 vulnerabilities - [Red Hat Developer Hub](https://junglewise.ai/threats/technologies/developer-hub): 28 vulnerabilities - [Red Hat Quay](https://junglewise.ai/threats/technologies/quay-3-12): 20 vulnerabilities - [Red Hat Multicluster Global Hub](https://junglewise.ai/threats/technologies/multicluster-global-hub): 19 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Red Hat Keycloak vulnerabilities", https://junglewise.ai/threats/technologies/red-hat-keycloak, 13 November 2026.