The Red Hat build of Keycloak 26.4.10 contains multiple security vulnerabilities affecting authentication and authorization mechanisms. Notable issues include authentication bypasses due to disabled SAML clients and identity providers (CVE-2026-3047, CVE-2026-3009, CVE-2026-2603), improper validation of encrypted SAML assertions allowing unauthorized access (CVE-2026-2092), denial of service caused by excessive decompression of SAML requests (CVE-2026-2575), response delays due to unchecked NotOnOrAfter timestamps in SAML brokering (CVE-2026-1190), missing checks on disabled clients for Docker Registry protocol (CVE-2026-2733), and potential security control bypass via authorization header parsing (CVE-2026-0707). These vulnerabilities collectively impact the integrity and availability of authentication services provided by Keycloak.

Successful exploitation of these vulnerabilities could allow attackers to bypass authentication controls, gain unauthorized access, cause denial of service conditions, or circumvent security controls in the affected Keycloak server. This could compromise the security of web and mobile applications relying on Keycloak for authentication and single sign-on.

Red Hat has released an updated package for the Red Hat build of Keycloak version 26.4.10 that addresses these vulnerabilities. Users should back up their existing installations, including applications, configuration files, and databases, before applying the update. Applying this update is the recommended remediation. No additional mitigations are specified by the vendor advisory.