Red Hat build of Keycloak 26.6.7, a standalone authentication and single sign-on server, contains numerous security vulnerabilities. These include disclosure of hidden groups, unauthorized member creation via invitation link exposure, retargeting of authorization codes, bypass of signed-JWT assertion policies, exposure of reCAPTCHA secrets, missing per-role authorization checks, privilege escalation through impersonation roles, unauthenticated remote file read, bypasses in external token exchanges, and remote code execution via prototype pollution. Additional issues involve TLS hostname verification bypass, incomplete fixes allowing policy enforcer bypass, unauthenticated denial of service via locale caching, and JWT Bearer authorization grant consent enforcement failures. The advisory lists 30+ CVEs addressed in this update.

The vulnerabilities collectively impact the confidentiality, integrity, and availability of the Keycloak server. They allow attackers to disclose sensitive information, bypass authorization controls, escalate privileges to realm administrator level, execute remote code, cause denial of service, and bypass security policies. These issues could lead to unauthorized access, data leakage, account takeover, and potential compromise of authentication infrastructure.

Red Hat has released an updated package for Red Hat build of Keycloak 26.6.7 that addresses these vulnerabilities. Users should back up their existing installations, including applications, configurations, and databases, before applying the update. Applying this security update is the recommended remediation. No additional mitigations are specified or required beyond installing the update.