This security advisory covers multiple vulnerabilities in Red Hat build of Keycloak 26.4.9, an integrated sign-on solution for OpenShift. The fixed issues include: CVE-2026-1529 (unauthorized organization registration due to improper invitation token validation), CVE-2026-1486 (disabled identity providers accepted for JWT Authorization Grant), CVE-2025-14778 (incorrect ownership checks in /uma-policy/), CVE-2026-0871 (unauthorized modification of unmanaged user attributes by administrators), CVE-2025-14559 (business logic flaw allowing unauthorized token issuance for disabled users), and CVE-2025-13881 (limited administrators retrieving sensitive user attributes via Admin API). The advisory releases new container images aligned with the standalone product release to address these issues for on-premise or private cloud deployments on OpenShift Container Platform.

The vulnerabilities collectively could allow unauthorized users or limited administrators to register organizations, bypass disabled identity provider restrictions, modify user attributes without authorization, issue tokens improperly, and access sensitive user information. This could lead to privilege escalation, unauthorized access to protected resources, and potential compromise of authentication and authorization mechanisms within affected Keycloak deployments.

Red Hat has released updated container images for Red Hat build of Keycloak 26.4.9 and its Operator to address these vulnerabilities. Users should back up their existing installations, including applications, configurations, and databases, before applying the update. Applying the updated images is the recommended remediation. No alternative mitigations or workarounds are specified in the advisory.