Red Hat Security Advisory: Red Hat build of Keycloak 26.0.17 Update

CVE-2025-10044 is an injection vulnerability in Red Hat build of Keycloak 26.0.17, specifically involving the error_description parameter on error pages. This vulnerability is categorized under CWE-79, indicating a cross-site scripting (XSS) or similar injection issue. The Red Hat advisory (RHSA-2025:19925) describes this as a moderate severity issue and recommends updating to the new build of Keycloak 26.0.17. However, the advisory does not explicitly confirm the availability of a patch or fixed version number. The vulnerability affects the standalone Keycloak server used for authentication and single sign-on capabilities.

The vulnerability allows injection of malicious content into error pages via the error_description parameter, which could potentially lead to cross-site scripting or other injection-based attacks. This may impact the security of authentication and single sign-on processes managed by Keycloak. No active exploitation has been reported, and the severity is assessed as moderate.

Red Hat recommends backing up existing installations, including applications, configuration files, and databases before applying updates. The advisory suggests updating to the new Red Hat build of Keycloak 26.0.17, implying that the update addresses the vulnerability. However, explicit patch details or fixed version numbers are not provided. Users should consult the Red Hat Customer Portal for the latest updates and apply them as soon as they become available.