The Red Hat build of Keycloak 26.4.12 contains multiple security vulnerabilities including denial of service via specially crafted SAML input (CVE-2026-7307), information disclosure through the evaluate-scopes Admin API (CVE-2026-37978), unauthorized account takeover via WebAuthn token replay (CVE-2026-37982), information disclosure via OIDC token introspection endpoint audience bypass (CVE-2026-37979), access token disclosure and implicit flow bypass via forged client data (CVE-2026-7571), session fixation in OIDC login flow leading to account takeover (CVE-2026-7507), open redirect via wildcard redirect URIs (CVE-2026-7504), information disclosure via broken access control in user lookup endpoint (CVE-2026-37981), and unauthorized resource access and data modification via insecure direct object reference (CVE-2026-4630). These vulnerabilities impact authentication, authorization, and session management components of Keycloak, potentially allowing attackers to disrupt service, disclose sensitive information, or take over user accounts. Red Hat has issued updated packages and container images for Keycloak 26.4.12 to address these issues.

The vulnerabilities collectively pose a high risk to the confidentiality, integrity, and availability of authentication services provided by Keycloak. Exploitation could lead to denial of service, unauthorized disclosure of sensitive information, account takeover, bypass of access controls, and unauthorized modification of resources. These impacts affect web and mobile applications relying on Keycloak for authentication and single sign-on, potentially compromising user accounts and application security.

Red Hat has released updated packages and container images for the Red Hat build of Keycloak 26.4.12 that address these vulnerabilities. Users should back up their existing installations, including applications, configuration files, and databases, before applying the update. Applying the official Red Hat security update is the recommended remediation. No alternative mitigations or workarounds are specified in the advisory.