This advisory covers two security vulnerabilities in the Red Hat build of Keycloak 26.0.10 for OpenShift. CVE-2025-0604 is an authentication bypass vulnerability due to a missing LDAP bind operation after a password reset, potentially allowing unauthorized access. CVE-2025-1391 is an improper authorization vulnerability in the Keycloak Organization Mapper component that permits unauthorized organization claims. Red Hat has released updated container images for Keycloak 26.0.10 and its Operator to remediate these issues. The advisory recommends applying these updated images in OpenShift Container Platform environments to mitigate the vulnerabilities.

The authentication bypass vulnerability (CVE-2025-0604) could allow attackers to bypass authentication controls after a password reset due to missing LDAP bind verification. The improper authorization vulnerability (CVE-2025-1391) could enable unauthorized users to obtain organization claims they should not have access to, potentially leading to privilege escalation or unauthorized access within Keycloak-managed environments. Both vulnerabilities are rated as moderate severity by Red Hat.

Red Hat has released updated container images for Keycloak 26.0.10 and the Keycloak Operator that address these vulnerabilities. Users should apply these updated images as provided by Red Hat to remediate the issues. Before applying this update, ensure all previously released errata relevant to your system have been applied. Refer to Red Hat's official update instructions at https://access.redhat.com/articles/11258 for guidance on applying the update. No alternative mitigations or workarounds are specified in the advisory.