Red Hat has issued a security update for the Red Hat build of Keycloak 26.4.16 images used in OpenShift Container Platform. The update addresses multiple vulnerabilities including privilege escalation via impersonation roles, information leakage through SAML Redirect DEFLATE helpers, account lockout caused by username collisions, incomplete fixes for filesystem path probing and policy enforcer bypass, TLS hostname verification bypass, and an unauthenticated denial-of-service via unbounded locale caching. These issues affect the Red Hat build of Keycloak versions from 26.4.0 up to and including 26.4.16. The update is important to maintain the security and integrity of authentication services in OpenShift environments.
Red Hat has issued a security update for the Red Hat build of Keycloak 26.6.7 images used in OpenShift Container Platform. The update addresses multiple security vulnerabilities including information disclosure, privilege escalation, authorization bypasses, remote code execution, and denial of service. Users are advised to apply the update to mitigate these risks.
A flaw was found in Keycloak. The cross-session verification proof is keyed only by (local userId,
idpAlias) and is not bound to the upstream identity that was actually verified, so a second upstream account on the same IdP can consume it and get linked to the victim's local account.
A flaw was found in Keycloak's URL validation logic during redirect operations. By crafting a malicious request, an attacker could bypass validation to redirect users to unauthorized URLs, potentially leading to the exposure of sensitive information within the domain or facilitating further attacks. This vulnerability specifically affects Keycloak clients configured with a wildcard (*) in the "Valid Redirect URIs" field and requires user interaction to be successfully exploited.
The issue stems from a discrepancy in how Keycloak and the underlying Java URI implementation handle the user-info component of a URL. If a malicious redirect URL is constructed using multiple @ characters in the user-info section, Java's URI parser fails to extract the user-info, leaving only the raw authority field. Consequently, Keycloak's validation check fails to detect the malformed user-info, falls back to a wildcard comparison, and incorrectly permits the malicious redirect.
A flaw was found in Keycloak. This access control vulnerability in Keycloak's OpenID Connect (OIDC) token introspection endpoint allows a confidential client to bypass audience restrictions. An attacker-controlled client with valid credentials can retrieve sensitive token claims intended for other resource servers, compromising the confidentiality of lightweight access tokens. This issue can be exploited remotely by any confidential client in the realm with valid credentials.
A flaw was found in Keycloak. The User-Managed Access (UMA) 2.0 Protection API endpoint for permission tickets fails to enforce the `uma_protection` role check. This allows any authenticated user with a token issued for a resource server client, even without the `uma_protection` role, to enumerate all permission tickets in the system. This vulnerability partial leads to information disclosure.
A flaw was found in Keycloak. A remote attacker could bypass security controls by sending a valid SAML response from an external Identity Provider (IdP) to the Keycloak SAML endpoint for IdP-initiated broker logins. This allows the attacker to complete broker logins even when the SAML Identity Provider is disabled, leading to unauthorized authentication.
A flaw was found in org.keycloak.broker.saml. When a disabled Security Assertion Markup Language (SAML) client is configured as an Identity Provider (IdP)-initiated broker landing target, it can still complete the login process and establish a Single Sign-On (SSO) session. This allows a remote attacker to gain unauthorized access to other enabled clients without re-authentication, effectively bypassing security restrictions.
CVE-2025-13467 is a medium severity vulnerability in Red Hat build of Keycloak 26.2 that allows an authenticated realm administrator to trigger deserialization of untrusted Java objects via a malicious LDAP server configuration. This flaw exists in the LDAP User Federation provider component. Exploitation requires high privileges (authenticated realm admin) and no user interaction. Red Hat has released updated Keycloak 26.2.11 images containing a fix for this issue. Users are advised to back up their installations and apply the update to mitigate the vulnerability.