The Red Hat build of Keycloak 26.0.10 update addresses multiple security vulnerabilities. Notably, CVE-2025-0604 involves an authentication bypass caused by a missing LDAP bind operation after a password reset, potentially allowing unauthorized access. CVE-2025-1391 concerns improper authorization in the organization mapper component, which could permit unauthorized users to obtain organization claims. These vulnerabilities impact the authentication and authorization mechanisms of Keycloak, a widely used identity and access management server. Red Hat has issued this advisory (RHSA-2025:2545) to provide fixes for these issues in their Keycloak build. No CVSS score is provided, but the advisory classifies the severity as moderate.

Successful exploitation of CVE-2025-0604 could allow an attacker to bypass authentication controls after a password reset due to missing LDAP bind verification. CVE-2025-1391 could enable unauthorized users to gain organization claims improperly, potentially leading to privilege escalation or unauthorized access to resources. These vulnerabilities undermine the integrity of authentication and authorization processes in Keycloak, affecting the security of applications relying on it for single sign-on.

Red Hat has released updated packages for the Red Hat build of Keycloak version 26.0.10 that address these vulnerabilities. Users should back up their existing installations, including applications, configuration files, and databases, before applying the update. Applying the official update from Red Hat is the recommended remediation. Patch status is confirmed by the vendor advisory. No additional mitigations are specified.