Skip to main content
EPSS 0.4%top 63%

Red Hat Security Advisory: Red Hat build of Keycloak 26.2.15 Update

0
High
Published: 04/02/2026 (04/02/2026, 13:53:32 UTC)
Source: GCVE Database
Vendor/Project: Red Hat Product Security
Product: Red Hat

Description

Red Hat has released an important security update for its build of Keycloak, version 26.2.15, addressing multiple vulnerabilities. These include information disclosure via redirect_uri validation bypass, replay of action tokens, UMA policy bypass allowing unauthorized resource access, privilege escalation through forged authorization codes, and denial of service via excessive OpenID Connect scope parameter processing. The update mitigates these issues to enhance authentication and single sign-on security for web and mobile applications.

Affected software

Affected versions
<26.2.15>=26.2.0 <26.2.1>=26.2.15 <26.3.0>=26.4.0 <26.4.1>=26.4.11 <26.5.0

AI-Powered Analysis

Machine-generated threat intelligence

AILast updated: 09/12/2026, 21:46:52 UTC

Technical Analysis

The Red Hat build of Keycloak 26.2.15 update fixes several security vulnerabilities: CVE-2026-3872 addresses information disclosure caused by a redirect_uri validation bypass; CVE-2026-4325 fixes replay attacks on action tokens due to improper handling of single-use entries; CVE-2026-4636 patches a UMA policy bypass that allows authenticated users unauthorized access to victim-owned resources; CVE-2026-4282 resolves a privilege escalation vulnerability via forged authorization codes exploiting a SingleUseObjectProvider isolation flaw; and CVE-2026-4634 mitigates a denial of service vulnerability caused by excessive processing of OpenID Connect scope parameters. These fixes are included in the Red Hat build of Keycloak 26.2.15 packages and related container images.

Potential Impact

Exploitation of these vulnerabilities could lead to unauthorized information disclosure, unauthorized access to resources, privilege escalation, replay of security tokens, and denial of service conditions affecting authentication services. These impacts compromise the confidentiality, integrity, and availability of authentication and authorization processes managed by Keycloak.

Mitigation Recommendations

A security update to Red Hat build of Keycloak 26.2.15 is available and should be applied. Before updating, back up existing installations, including applications, configuration files, and databases. The vendor advisory confirms that the update addresses all listed vulnerabilities. No additional mitigation steps are specified beyond applying the official update.

Pro Console: star threats, build custom feeds, automate alerts via Slack, email & webhooks.Upgrade to Pro

Technical Details

Gcve Source
db.gcve.eu
Csaf Category
csaf_security_advisory
Csaf Version
2.0
Publisher
Red Hat Product Security
Advisory Id
RHSA-2026:6475
Cve Count
5
Additional Cves
["CVE-2026-4282","CVE-2026-4325","CVE-2026-4634","CVE-2026-4636"]
State
PUBLISHED

Threat ID: 6a4049d727e9c7971982e423

Added to database: 06/27/2026, 22:08:23 UTC

Last enriched: 09/12/2026, 21:46:52 UTC

Last updated: 09/14/2026, 22:01:33 UTC

Views: 111

Community Reviews

0 reviews

Crowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.

Sort by
Loading community insights…

Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.

Actions

PRO

Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.

Please log in to the Console to use AI analysis features.

Need more coverage?

Upgrade to Pro Console for AI refresh and higher limits.

For incident response and remediation, OffSeq services can help resolve threats faster.

Latest Threats

Breach by OffSeqOFFSEQFRIENDS — 25% OFF

Check if your credentials are on the dark web

Instant breach scanning across billions of leaked records. Free tier available.

Scan now
OffSeq TrainingCredly Certified

Lead Pen Test Professional

Technical5-day eLearningPECB Accredited
View courses