The Red Hat build of Keycloak 26.6.5 contains multiple security vulnerabilities spanning authorization bypasses (e.g., admin-ui-ext bulk role-mapping-delete endpoints, FGAPv2 client scope assignments), privilege escalation (DCR protocol mapper type-swap policy bypass), denial of service (unbounded multipart MIME headers, crafted gRPC and HTTP requests), arbitrary code execution (PolymorphicTypeValidator bypass, security bypass), and security policy bypasses (JWE-encrypted request object processing, OIDC redirect URI HTTP parameter pollution). These issues affect authentication and single sign-on capabilities, potentially compromising access controls and system stability. The advisory references 19 CVEs, including CVE-2026-9689 and CVE-2026-9793 among others, and recommends updating to the new Red Hat build of Keycloak 26.6.5 packages.

The vulnerabilities collectively could allow attackers to bypass authorization controls, escalate privileges, cause denial of service conditions, and execute arbitrary code within the Keycloak authentication server environment. This impacts the security of web and mobile applications relying on Keycloak for authentication and single sign-on, potentially leading to unauthorized access, data compromise, and service disruption.

Red Hat has released updated packages for the Red Hat build of Keycloak 26.6.5 that address these vulnerabilities. Users should back up their existing installations, including applications, configuration files, and databases, before applying the update. Since the advisory indicates updated packages are available from the Red Hat Customer Portal, applying these official fixes is the recommended mitigation. No additional vendor advisories indicate that no action is required or that these issues are already mitigated.