The Red Hat build of Keycloak 26.2.6 includes fixes for two security issues. CVE-2025-7365 addresses a phishing attack vector exploiting the email verification step during the first login flow, categorized under CWE-346 (Origin Validation Error). CVE-2025-7784 fixes a privilege escalation vulnerability in the Keycloak Admin Console when FGAPv2 is enabled, related to CWE-269 (Improper Privilege Management). These vulnerabilities could allow attackers to deceive users during authentication or escalate privileges within the admin console. Red Hat has issued a security advisory (RHSA-2025:12015) recommending updating to the fixed version 26.2.6.

The phishing vulnerability (CVE-2025-7365) could enable attackers to trick users during the email verification step of the first login, potentially compromising user credentials or session integrity. The privilege escalation vulnerability (CVE-2025-7784) could allow an attacker with limited access to gain higher administrative privileges in the Keycloak Admin Console if FGAPv2 is enabled. Both issues impact the security of authentication and administrative controls, potentially undermining the trustworthiness of the single sign-on environment.

Red Hat has released an official security update in version 26.2.6 of their Keycloak build that addresses these vulnerabilities. Users should back up their existing installations, including configurations and databases, and apply the update from the Red Hat Customer Portal. No additional mitigations are specified or required beyond applying the official update.