This advisory covers a set of security fixes in Red Hat build of Keycloak 26.4.11 and its Operator for OpenShift. Vulnerabilities addressed include improper access control leading to sensitive role metadata and information disclosure (CVE-2025-14082, CVE-2025-14083), insecure direct object references (CVE-2025-14777), refresh token reuse bypass via race condition (CVE-2026-1035), blind SSRF via jwks_uri in OIDC dynamic client registration (CVE-2026-1180), information disclosure through improper role enforcement in UMA 2.0 Protection API (CVE-2026-3190), privilege escalation via manage-clients permission (CVE-2026-3121), redirect_uri validation bypass (CVE-2026-3872), MFA deletion and account takeover via improper access control (CVE-2026-3429), authorization bypass in Admin API (CVE-2026-2366), replay of action tokens (CVE-2026-4325), UMA policy bypass (CVE-2026-4636), privilege escalation via forged authorization codes (CVE-2026-4282), and denial of service via excessive OpenID Connect scope processing (CVE-2026-4634). These vulnerabilities affect the Red Hat build of Keycloak versions from 26.4.0 through 26.4.11. The advisory recommends updating to the new images released for these versions.

The vulnerabilities collectively allow attackers to gain unauthorized access to sensitive role metadata, perform information disclosure, escalate privileges, bypass authorization controls, conduct SSRF attacks, replay tokens, and cause denial of service conditions. These impacts can lead to unauthorized resource access, account takeover, and disruption of authentication services within environments using the affected Keycloak versions.

Red Hat has released updated images for Red Hat build of Keycloak 26.4.11 and its Operator that address these vulnerabilities. Users should back up their existing installations and apply the updated images as provided by Red Hat. No additional mitigation steps are indicated beyond applying the official update.