The Red Hat build of Keycloak 26.2.15 update fixes several security vulnerabilities: CVE-2026-3872 addresses information disclosure caused by a redirect_uri validation bypass; CVE-2026-4325 fixes replay attacks on action tokens due to improper handling of single-use entries; CVE-2026-4636 patches a UMA policy bypass that allows authenticated users unauthorized access to victim-owned resources; CVE-2026-4282 resolves a privilege escalation vulnerability via forged authorization codes exploiting a SingleUseObjectProvider isolation flaw; and CVE-2026-4634 mitigates a denial of service vulnerability caused by excessive processing of OpenID Connect scope parameters. These fixes are included in the Red Hat build of Keycloak 26.2.15 packages and related container images.

Exploitation of these vulnerabilities could lead to unauthorized information disclosure, unauthorized access to resources, privilege escalation, replay of security tokens, and denial of service conditions affecting authentication services. These impacts compromise the confidentiality, integrity, and availability of authentication and authorization processes managed by Keycloak.

A security update to Red Hat build of Keycloak 26.2.15 is available and should be applied. Before updating, back up existing installations, including applications, configuration files, and databases. The vendor advisory confirms that the update addresses all listed vulnerabilities. No additional mitigation steps are specified beyond applying the official update.