This advisory covers a set of 15 security vulnerabilities in Red Hat build of Keycloak 26.4.11, a standalone authentication server. The vulnerabilities include improper access control in the Admin REST API (CVE-2025-14082, CVE-2025-14083), insecure direct object references (CVE-2025-14777), refresh token reuse bypass via race condition (CVE-2026-1035), blind SSRF in OIDC dynamic client registration (CVE-2026-1180), information disclosure due to role enforcement and redirect_uri validation bypass (CVE-2026-3190, CVE-2026-3872), privilege escalation via manage-clients permission and forged authorization codes (CVE-2026-3121, CVE-2026-4282), MFA deletion and account takeover via improper access control (CVE-2026-3429), replay of action tokens (CVE-2026-4325), UMA policy bypass (CVE-2026-4636), and denial of service through excessive OpenID Connect scope processing (CVE-2026-4634). These issues affect the security posture of Keycloak's authentication and authorization mechanisms. The advisory is identified as RHSA-2026:6477 and is classified as important by Red Hat Product Security.

The vulnerabilities collectively allow attackers to bypass access controls, disclose sensitive role metadata and user attributes, escalate privileges, perform unauthorized actions such as client creation/deletion, bypass multi-factor authentication protections, and cause denial of service. This could lead to unauthorized access to protected resources, account takeover, and disruption of authentication services. No known exploits in the wild have been reported at the time of the advisory.

Red Hat has released updated packages for Red Hat build of Keycloak 26.4.11 that address these vulnerabilities. Users are advised to back up their existing installations, including applications, configurations, and databases, before applying the update. Applying the update will mitigate the described security issues. No additional vendor-recommended mitigations or workarounds are specified in the advisory.