This advisory covers security fixes in Red Hat build of Keycloak 26.2.16 images for OpenShift. The vulnerabilities include CVE-2026-7307, which allows denial of service through specially crafted SAML input; CVE-2026-7507, a session fixation vulnerability in the OIDC login flow that could lead to account takeover; and CVE-2026-7504, an open redirect vulnerability when wildcard redirect URIs are used. The update aligns with the standalone Keycloak product release and is intended for on-premise or private cloud deployments using OpenShift Container Platform. No CVSS scores are provided. The vendor advisory recommends backing up existing installations before applying the update. No known exploits in the wild have been reported. The advisory does not explicitly state patch availability but provides new images as the fix.

The vulnerabilities impact authentication and session management in Keycloak, potentially allowing denial of service, account takeover via session fixation, and open redirect attacks that could facilitate phishing or redirect users to malicious sites. These issues could compromise user account security and disrupt service availability in environments using the affected Keycloak images.

Red Hat has released updated Keycloak 26.2.16 container images for OpenShift that address these vulnerabilities. Users should back up their existing installations, including applications, configurations, and databases, before applying the update. Deploying the updated images will mitigate the identified security issues. Patch status is confirmed by the availability of new images as per the Red Hat advisory. No additional vendor mitigation instructions contradict this update.