This advisory addresses several security vulnerabilities in Red Hat build of Keycloak 26.4.12, a standalone authentication and single sign-on server. The issues include CVE-2026-7307 (Denial of Service via crafted SAML input), CVE-2026-37978 (Information disclosure via evaluate-scopes Admin API), CVE-2026-37982 (Unauthorized account takeover via WebAuthn token replay), CVE-2026-37979 (Information disclosure via OIDC token introspection audience bypass), CVE-2026-7571 (Access token disclosure and implicit flow bypass via forged client data), CVE-2026-7507 (Session fixation leading to account takeover), CVE-2026-7504 (Open redirect with wildcard redirect URIs), CVE-2026-37981 (Information disclosure via broken access control in user lookup), and CVE-2026-4630 (Unauthorized resource access and data modification via Insecure Direct Object Reference). These vulnerabilities impact authentication flows, token handling, and access controls, potentially allowing attackers to disrupt service, disclose sensitive information, or take over user accounts.

The vulnerabilities can lead to denial of service conditions, unauthorized disclosure of sensitive information through API endpoints, unauthorized account takeover via token replay and session fixation attacks, bypass of token audience restrictions, open redirect vulnerabilities that may facilitate phishing, and unauthorized access or modification of resources due to insecure direct object references. These impacts compromise confidentiality, integrity, and availability of the authentication service and user data.

Red Hat has released updated packages for Red Hat build of Keycloak 26.4.12 addressing these vulnerabilities. Users should back up their existing installations, including applications, configurations, and databases, before applying the update. Applying the official Red Hat security update is the recommended remediation. No alternative mitigations or workarounds are specified in the advisory.