The Red Hat build of Keycloak 26.4.11 contains multiple security vulnerabilities such as improper access control in the Admin REST API leading to sensitive role metadata disclosure (CVE-2025-14082) and other information disclosures (CVE-2025-14083), an IDOR vulnerability in realm client creation/deletion (CVE-2025-14777), a refresh token reuse bypass via a TOCTOU race condition (CVE-2026-1035), blind SSRF in OIDC dynamic client registration (CVE-2026-1180), privilege escalation via manage-clients permission (CVE-2026-3121), and several other issues including MFA deletion leading to account takeover, authorization bypass, replay of action tokens, UMA policy bypass, forged authorization code privilege escalation, and denial of service via OpenID Connect scope parameters. These vulnerabilities collectively impact authentication, authorization, and session management functionalities of Keycloak.

These vulnerabilities can lead to unauthorized disclosure of sensitive role metadata and user attributes, privilege escalation, account takeover, unauthorized access to victim-owned resources, denial of service, and bypass of security controls such as multi-factor authentication and authorization enforcement. Exploitation could compromise the integrity and confidentiality of authentication and authorization processes in applications relying on Keycloak for single sign-on.

Red Hat has released updated packages for Red Hat build of Keycloak 26.4.11 that address these vulnerabilities. Users should back up their existing installations, including applications, configuration files, and databases, and apply the update from the Red Hat Customer Portal as soon as possible to remediate these issues. No additional mitigations are specified beyond applying the official update.