This advisory covers two security vulnerabilities in Red Hat's build of Keycloak 26.2.6 images for OpenShift. CVE-2025-7365 involves a phishing attack vector exploiting the email verification step during the first login flow, categorized under CWE-346 (Origin Validation Error). CVE-2025-7784 is a privilege escalation vulnerability in the Keycloak Admin Console when FGAPv2 is enabled, related to CWE-269 (Improper Privilege Management). Red Hat has released updated container images to address these issues, intended for use in on-premise or private cloud OpenShift deployments. The advisory does not specify affected version ranges but aligns with the 26.2.6 release. No CVSS scores are provided. The vulnerabilities impact authentication and administrative functions, potentially allowing phishing attacks and unauthorized privilege escalation.

The phishing vulnerability (CVE-2025-7365) could allow attackers to exploit the email verification step in the first login flow, potentially deceiving users and compromising authentication processes. The privilege escalation vulnerability (CVE-2025-7784) could allow an attacker with access to the Keycloak Admin Console to gain elevated privileges when FGAPv2 is enabled, potentially leading to unauthorized administrative actions. Both vulnerabilities affect the security posture of the authentication server and user management capabilities within the affected Keycloak deployment.

Red Hat has released updated container images for Keycloak 26.2.6 that address these vulnerabilities. Users should apply these updated images as provided by Red Hat. Before updating, it is recommended to back up existing installations, including applications, configuration files, and databases. Since this is not a cloud service, remediation is managed by the user applying the updated images. Patch status is confirmed by the vendor advisory indicating new images are available. No additional mitigation steps are specified by Red Hat.