The Red Hat security advisory RHSA-2026:50846 for Red Hat build of Keycloak 26.4.14 addresses 17 security vulnerabilities. These include privilege escalation via hardcoded role mapper injection (CVE-2026-4629), arbitrary code execution through PolymorphicTypeValidator bypass (CVE-2026-54512 and CVE-2026-54513), multiple authorization bypasses via unnormalized URI matching, incorrect URI comparison, and bypasses of FGAPv2 user view restrictions and client scope assignments. Additional issues include denial of service via unbounded multipart MIME header accumulation (CVE-2026-16308), SAML broker metadata import disabling response signature validation, LDAP user search bypassing DN boundaries, HTTP Parameter Pollution in OIDC redirect URI, and brute-force protection bypass in CIBA flow. The advisory does not provide explicit patch links or fixed versions but indicates the availability of updated packages from Red Hat Customer Portal.

These vulnerabilities collectively allow attackers to bypass authorization controls, escalate privileges, execute arbitrary code, cause denial of service, and bypass security protections in Keycloak authentication and single sign-on services. Exploitation could compromise authentication integrity and user access controls, potentially leading to unauthorized access and system compromise. No known exploits in the wild have been reported at this time.

Red Hat has released updated packages for Red Hat build of Keycloak 26.4.14 addressing these vulnerabilities. Users should apply the security update available from the Red Hat Customer Portal. Before updating, back up existing installations including applications, configuration files, and databases. Patch status is confirmed by the vendor advisory indicating an official fix is available. No additional vendor-recommended mitigations or workarounds are specified.