This advisory covers a security update for Red Hat build of Keycloak 26.4.13, a standalone authentication and single sign-on server. It addresses multiple vulnerabilities including information disclosure via CORS header injection (CVE-2026-37977), server-side request forgery via OIDC token endpoint manipulation (CVE-2026-4874), denial of service via TLS handshake issues (CVE-2026-6860), improper access control when the Account API is disabled (CVE-2026-7500), policy bypass during WebAuthn registration (CVE-2026-8830), various privilege escalations, authorization bypasses, and denial of service attacks. The update resolves at least 20 CVEs impacting confidentiality, integrity, and availability of the Keycloak server. The CVSS vector for CVE-2026-4874 indicates network attack vector, high attack complexity, low privileges required, no user interaction, and low confidentiality impact. The advisory is published by Red Hat Product Security under RHSA-2026:30049.

The vulnerabilities collectively impact the confidentiality, integrity, and availability of the Red Hat build of Keycloak 26.4.13 server. They enable attackers to perform information disclosure, privilege escalation, unauthorized access to resources, denial of service, and bypass of security policies. Specific impacts include leakage of sensitive information via CORS headers, token endpoint manipulation leading to server-side request forgery, denial of service through malformed TLS handshakes or LDAP responses, privilege escalation from group-admin to realm-admin, and unauthorized account access via replayed tokens. These flaws could undermine authentication and authorization mechanisms critical to secure single sign-on operations.

Red Hat has released updated packages for Red Hat build of Keycloak 26.4.13 that address these vulnerabilities. Users should apply the security update available from the Red Hat Customer Portal as soon as possible. Before updating, it is recommended to back up existing installations, including applications, configuration files, and databases. No alternative mitigations or workarounds are specified in the advisory. Patch status is confirmed by the vendor advisory indicating an official fix is available.