The Red Hat build of Keycloak 26.0.15 update addresses two security vulnerabilities: CVE-2025-9162, which involves variable injection into environment variables, and CVE-2025-8419, an SMTP injection vulnerability. Both issues could potentially impact the security of authentication and single sign-on services provided by Keycloak. The advisory does not specify exact affected versions or provide a CVSS score but categorizes the severity as moderate. The update is available from Red Hat's Customer Portal, and users should back up their systems before applying it.

The vulnerabilities could allow injection attacks affecting environment variables and SMTP functionality within the Keycloak server, potentially leading to unauthorized actions or information disclosure within authentication and single sign-on processes. The advisory rates the severity as moderate, indicating a significant but not critical risk. There are no known exploits in the wild at the time of the advisory.

Red Hat has released an updated package for Keycloak 26.0.15 that addresses these vulnerabilities. Users should back up their existing installations, including applications, configuration files, and databases, before applying the update available from the Red Hat Customer Portal. Patch status is confirmed as an official fix provided by Red Hat. No additional mitigation steps are indicated in the advisory.