Red Hat Security Advisory: Red Hat build of Keycloak 26.2.6 Security Update

The Red Hat build of Keycloak 26.2.6 security update fixes two vulnerabilities. CVE-2025-7365 involves a phishing attack vector exploiting the email verification step during the first login flow, potentially allowing attackers to deceive users. CVE-2025-7784 is a privilege escalation vulnerability in the Keycloak Admin Console when FGAPv2 is enabled, which could allow unauthorized privilege gains. These issues affect Red Hat build of Keycloak versions >=26.0.0 and <26.2.6. The vendor advisory confirms the availability of updated packages to remediate these vulnerabilities.

Exploitation of CVE-2025-7365 could enable attackers to conduct phishing attacks during the email verification step of the initial login, potentially compromising user credentials or session integrity. CVE-2025-7784 could allow an attacker with some level of access to escalate privileges within the Keycloak Admin Console if FGAPv2 is enabled, increasing the risk of unauthorized administrative actions. Both vulnerabilities pose a moderate risk to the confidentiality and integrity of authentication and authorization processes.

Red Hat has released version 26.2.6 of their build of Keycloak which includes fixes for these vulnerabilities. Users should back up their existing installations, including applications, configuration files, and databases, before applying the update. Applying the update to version 26.2.6 or later fully mitigates these issues. No alternative mitigations or workarounds are indicated in the vendor advisory.