The Red Hat build of Keycloak 26.2.16 includes fixes for three security vulnerabilities: CVE-2026-7307, which allows denial of service through specially crafted SAML input; CVE-2026-7507, a session fixation vulnerability in the OpenID Connect login flow that can lead to account takeover; and CVE-2026-7504, an open redirect vulnerability when wildcard valid redirect URIs are used. These issues impact the authentication and single sign-on functionality of Keycloak. Red Hat has released updated packages to address these vulnerabilities as part of advisory RHSA-2026:19594.

Successful exploitation of CVE-2026-7307 can cause denial of service, potentially disrupting authentication services. CVE-2026-7507 can allow an attacker to fix a session in the OIDC login flow, leading to account takeover. CVE-2026-7504 can enable open redirect attacks, which may be used in phishing or redirecting users to malicious sites. These vulnerabilities collectively pose a high risk to the security and integrity of authentication processes in affected Keycloak deployments.

Red Hat has released updated packages for the build of Keycloak 26.2.16 that address these vulnerabilities. Users should back up their existing installations, including applications, configuration files, and databases, before applying the update. Applying the official Red Hat update as described in advisory RHSA-2026:19594 is the recommended remediation. No additional vendor advisories indicate alternative mitigations or that no action is required.