The Red Hat build of Keycloak 26.2.6, a standalone authentication and single sign-on server, contains two security vulnerabilities. CVE-2025-7365 involves a phishing attack vector exploiting the email verification step during the initial login flow. CVE-2025-7784 is a privilege escalation vulnerability in the Keycloak Admin Console when FGAPv2 is enabled. Red Hat has released updated packages to address these issues, and users are advised to back up their installations before applying the update. No CVSS score is provided, but the advisory classifies the severity as moderate.

The vulnerabilities could allow attackers to conduct phishing attacks during the email verification step of the first login, potentially compromising user credentials or session integrity (CVE-2025-7365). The privilege escalation flaw (CVE-2025-7784) could enable an attacker with limited access to gain higher administrative privileges within the Keycloak Admin Console when FGAPv2 is enabled. These issues impact the security of authentication and administrative functions, potentially undermining the trustworthiness of the authentication system.

Red Hat has released updated packages for the Red Hat build of Keycloak 26.2.6 that address these vulnerabilities. Users should back up their existing installations, including applications, configuration files, and databases, before applying the update. Applying the official Red Hat update is the recommended remediation. Patch status is confirmed as available via Red Hat's Customer Portal under advisory RHSA-2025:12015.