This advisory concerns security vulnerabilities in the Red Hat build of Keycloak 26.2.16 container images for OpenShift. The vulnerabilities include: CVE-2026-7307, a denial of service triggered by specially crafted SAML input; CVE-2026-7507, a session fixation vulnerability in the OpenID Connect (OIDC) login flow that could lead to account takeover; and CVE-2026-7504, an open redirect vulnerability when wildcard valid redirect URIs are used. Red Hat has released updated container images for Keycloak 26.2.16 and its Operator to address these issues. The advisory recommends backing up existing installations before applying the update. No explicit patch version numbers or fixed versions are provided in the advisory, but updated images are available.

The denial of service vulnerability (CVE-2026-7307) could allow attackers to disrupt authentication services via crafted SAML input. The session fixation vulnerability (CVE-2026-7507) in the OIDC login flow could enable attackers to hijack user sessions and potentially take over accounts. The open redirect vulnerability (CVE-2026-7504) could be exploited to redirect users to malicious sites, potentially facilitating phishing attacks. These vulnerabilities impact the security and integrity of authentication and session management in Keycloak deployments on OpenShift.

Red Hat has released updated container images for Keycloak 26.2.16 and its Operator that address these vulnerabilities. Users should back up their existing installations, including applications, configuration files, and databases, before applying the update. Deploying the updated images will mitigate the described vulnerabilities. Since this is not a cloud service, remediation is managed by the user applying the updated images. Patch status is confirmed by the vendor advisory indicating new images are available. No additional mitigations are specified in the advisory.