Red Hat Jbosseapxp
Don't miss out!
Thousands of developers use stack.watch to stay informed.Get an email whenever new security vulnerabilities are reported in Red Hat Jbosseapxp.
By the Year
In 2026 there have been 203 vulnerabilities in Red Hat Jbosseapxp with an average score of 7.1 out of ten. Last year, in 2025 Jbosseapxp had 13 security vulnerabilities published. That is, 190 more vulnerabilities have already been reported in 2026 as compared to last year. However, the average CVE base score of the vulnerabilities in 2026 is greater by 0.62.
| Year | Vulnerabilities | Average Score |
|---|---|---|
| 2026 | 203 | 7.12 |
| 2025 | 13 | 6.50 |
| 2024 | 19 | 6.49 |
| 2023 | 1 | 4.40 |
It may take a day or so for new Jbosseapxp vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.
Recent Red Hat Jbosseapxp Security Vulnerabilities
Undertow WebSocket DoS via PerMessageDeflate Buffer Doubling
CVE-2026-5680
7.5 - High
- August 27, 2026
A flaw was found in Undertow. A remote attacker could exploit this vulnerability by sending specially crafted WebSocket messages with permessage-deflate negotiated. This could lead to excessive memory consumption due to the PerMessageDeflateFunction.largerBuffer() method using exponential doubling, resulting in a Denial of Service (DoS) for the affected application.
Allocation of Resources Without Limits or Throttling
WildFly Elytron Unicode Normalization Weakens Password Hashing
CVE-2026-19611
7.4 - High
- August 20, 2026
A flaw was found in WildFly Elytron. Password hashing and verification normalize input with Unicode NFKC, which can collapse fullwidth characters to ASCII equivalents. A remote attacker can more easily guess affected passwords by using an ASCII-only dictionary against accounts whose passwords were intended to include those non-ASCII characters, leading to unauthorized access.
Improper Handling of Alternate Encoding
mod_cluster AdvertiseListener NullPointerException via UDP Multicast
CVE-2026-76166
4.3 - Medium
- August 19, 2026
A flaw was found in mod_cluster's AdvertiseListenerImpl (org.jboss.modcluster core module). A single crafted UDP multicast datagram with a valid HTTP status line and a "Server:" header but without the "Date:", "Digest:", and "Sequence:" headers triggers a NullPointerException in verifyDigest() that is not caught by the worker thread's exception handler. This causes the advertise listener thread to terminate permanently. The failure is silent (isListening() continues to return true) and persists until the node is restarted. The crash occurs before the AdvertiseSecurityKey comparison, so deployments with a configured security key are still affected.
NULL Pointer Dereference
Predictable Hash Enables Account-Takeover via Keycloak Linking URL
CVE-2026-15571
7.3 - High
- August 18, 2026
A flaw was found in the legacy client-initiated account-linking endpoint of Keycloak, a widely used open-source identity and access management solution. The mechanism used to protect the account-linking process from unauthorized requests relies on a hash that can be predicted by a malicious OIDC client. By tricking a user into authenticating, an attacker-controlled client can forge a valid linking URL to connect the victim's account to an attacker's external identity. This results in a full account takeover, allowing the attacker to log in as the victim.
Predictable from Observable State
Unauthenticated Reset Credentials in KeycloakServices (Red Hat Build)
CVE-2026-18963
9.1 - Critical
- August 18, 2026
A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak. The issue allows an unauthenticated attacker to force the password reset process for any user without needing to click the required email verification link. This can result in the attacker gaining full control over target user accounts by directly setting new credentials.
Weak Password Recovery Mechanism for Forgotten Password
Encoding Truncation in Undertow Response Header Writes
CVE-2026-19879
5.3 - Medium
- August 14, 2026
A flaw was found in Undertow, an HTTP server, within its HTTP response header writing path. The `writeString()` method performs a silent narrowing cast from 16-bit Unicode characters to 8-bit bytes when writing HTTP response header values. A remote attacker can exploit this by supplying specific Unicode characters in user-controlled input that an application places into response headers. This can lead to the truncation of these characters into ASCII control characters or special symbols, potentially resulting in limited integrity impact or information disclosure if the application does not properly sanitize user input.
Incorrect Conversion between Numeric Types
Undertow ChunkReader State Overlap Allows Chunked Request Bypass
CVE-2026-14180
5.3 - Medium
- August 11, 2026
A flaw was found in the ChunkReader component of the Undertow HTTP server, which is used by WildFly and JBoss EAP to handle chunked transfer encoding. The issue occurs because the parser uses a single internal variable to store both the remaining chunk size and state flags. By sending a specially crafted request with an extremely large chunk size, an attacker can cause these values to overlap, tricking the parser into thinking a request has finished prematurely. This can allow a second, "smuggled" request to be processed out of sync, potentially bypassing security controls.
HTTP Request Smuggling
Wildfly OOM via CSIv2Util GSS Token Length Field Unchecked
CVE-2026-15567
7.5 - High
- August 11, 2026
A flaw was found in Wildfly. A remote unauthenticated attacker can trigger OutOfMemoryError as CSIv2Util's GSS token decoder reads an attacker-controlled length field without bounds checking and attempts to allocate a byte array of that size.
Stack Exhaustion
Undertow @ServerEndpoint WebSocket OOM DoS
CVE-2026-15565
7.5 - High
- August 11, 2026
A flaw was found in Undertow. A remote attacker can cause Out of Memory on websockets endpoint without authentication on any @ServerEndpoint class that has any @OnMessage method. This allows an attacker to cause Denial of Service attack without authentication and using only a standard WebSocket handshake.
Classic Buffer Overflow
JBoss EAP IIOP NS Auth Bypass: Unauthenticated Bind Hijacks JNDI
CVE-2026-15563
7.4 - High
- August 11, 2026
A flaw was found in EAP's IIOP. The listener's NameService would accept bind operations without authentication, allowing an attacker to hijack JNDI lookups and binding them to a malicious ORB, achieving MITM or DoS on further invocations.
Missing Authentication for Critical Function
Red Hat JBoss EAP jboss-remoting OOM DoS via Upgrade Handshake
CVE-2026-15562
7.5 - High
- August 11, 2026
A flaw was found in EAP's jboss-remoting. A remote unauthenticated attacker who can reach :8080 (or :9990, or :4447) and complete an Upgrade: jboss-remoting handshake can cause OOM errors that degrade requests server-wide, leading to denial of service.
Integer Overflow or Wraparound
JBoss EAP Undertow Chunked-Transfer OOM DoS via HTTP1.1
CVE-2026-15561
7.5 - High
- August 11, 2026
A flaw was found in EAP's undertow http/1.1 chunked-transfer decoder. missing limits on size and count would allow an attacker to use an unauthenticated connection to drive the JVM to an OutOfMemory error, stopping all deployments on the listener, and achieving Denial of Service.
Allocation of Resources Without Limits or Throttling
EAP JDKBridge Unchecked Remote Code Exec via Attacker-supplied CDR Codebase
CVE-2026-15560
8.1 - High
- August 11, 2026
when EAP runs with -secmgr, the openjdk-orb's JDKBridge honours attacker-supplied CDR codebase URLs during object unmarshalling on :3528, allowing an unauthenticated attacker to load and instantiate arbitrary classes from a remote URL in the server JVM before EJB security interceptors run.
Inclusion of Functionality from Untrusted Control Sphere
Picketlink SP Signature Validation Flaw: Forged SAML Response Vulnerability
CVE-2026-15556
8.1 - High
- August 11, 2026
A flaw was found in Picketlink's SP signature validation; a SAML response containing zero assertion elements matching the signature check can allow an attacker to forge a SAML response and auth as any principal with any roles on the protected application.
Improper Verification of Cryptographic Signature
CVE-2026-15555: JBoss Marshaller RCE via Infinispan deserialization
CVE-2026-15555
8.8 - High
- August 11, 2026
A flaw was found in JBoss marshalling. The Infinispan session replication path deserializes replicated session data via the JBoss Marshalling River unmarshaller with no class filtering enabling RCE via deserialization gadget chains on every cluster node.
Marshaling, Unmarshaling
Undertow AJP Listener Bypass CLIENT-CERT Auth via Forged X.509 Cert
CVE-2026-15554
7.4 - High
- August 11, 2026
the Undertow AJP listener honours forged ssl_cert and is_ssl AJP attributes without requiring any shared-secret authentication. This enables an unauthenticated attacker with direct TCP access to port 8009 to bypass CLIENT-CERT authentication by injecting a forged X.509 certificate via the AJP protocol.
Improper Certificate Validation
WildFly Core Remote Authenticated Deployment via Malicious Archive Upload
CVE-2026-24330
6.5 - Medium
- August 11, 2026
A flaw was found in wildfly-core. A remote attacker, authenticated as a 'deployer' account, can import and deploy a malicious archive file from an untrusted source. This is achieved by leveraging WildFly libraries to craft a Java project that allows an HTTP POST request to upload and deploy the malicious archive. This could lead to further exploitation, such as arbitrary file read vulnerabilities.
Unrestricted File Upload
WildFly Core: Malicious Inet Address Payload Crashes Config (DoS)
CVE-2026-24329
4.9 - Medium
- August 11, 2026
A flaw was found in wildfly-core. A remote user authenticated as an administrative user can inject a malformed payload into the Inet Address field through the Management Model. This injection causes the server to crash and become unrecoverable, as the payload is written into the standalone.xml configuration file. Manual intervention is required to restore server operation, leading to a denial of service.
aka Blind XPath Injection
SAML Broker One-Time Use (OTU) Bypass in Keycloak
CVE-2026-18967
6.4 - Medium
- August 06, 2026
A flaw was found in the SAML broker component of Keycloak, an identity and access management solution. When configured as a SAML broker using the IdP-Initiated flow, Keycloak fails to enforce the OneTimeUse condition in SAML assertions. This allows an attacker who captures a valid, unused assertion to replay it multiple times. Successful exploitation could allow an attacker to hijack a user's session and gain unauthorized access to the system as that user.
Authentication Bypass by Capture-replay
Keycloak SAML Broker SSO Bypass via IdP Account Linking
CVE-2026-16442
7.4 - High
- August 05, 2026
A flaw was found in the SAML broker component of Keycloak, which is used to manage identity federation and user authentication. The issue occurs because the IdP-initiated Single Sign-On endpoint fails to check if a provider is restricted to account linking only. This allows an attacker with control over a linked upstream identity to bypass login restrictions and gain full access to a local user account.
Origin Validation Error
Keycloak Prometheus Metric Label DoS via Memory Exhaustion
CVE-2026-16100
6.5 - Medium
- August 05, 2026
A flaw was found in the user-event metrics recording of Keycloak. When metrics are enabled, the system records raw error messages from failed account operations as Prometheus metric labels. Because these error messages can include user-supplied input like nonexistent client IDs, an authenticated user can create a massive number of unique metric entries, eventually exhausting system memory and causing the service to crash or become unavailable.
Allocation of Resources Without Limits or Throttling
LDAP DN Boundary Bypass in Keycloak LDAP Storage Provider
CVE-2026-16071
5.4 - Medium
- August 05, 2026
A flaw was found in the LDAP storage provider of Keycloak, which is used to federate user identities from external directories. The issue occurs when a delegated administrator performs a search using a specific LDAP entry Distinguished Name (DN). Due to missing validation, the system allows lookups for users located outside the configured search boundary, leading to the disclosure of account information from unauthorized parts of the directory and unintended importing of those users into local storage.
Improper Privilege Management
Keycloak DCR Path Validation Flaw Enables Privilege Escalation
CVE-2026-16102
8.1 - High
- August 05, 2026
A flaw was found in the Dynamic Client Registration (DCR) component of Keycloak, an identity and access management solution. The default DCR policy fails to properly validate the claim path for User Property mappers, allowing them to write values to sensitive internal claim locations. An attacker with a standard user account and a limited Initial Access Token can exploit this to forge administrative roles in their access token. This allows the attacker to take over other clients, steal confidential secrets, and potentially gain full administrative control over the realm.
Authorization
Keycloak PathMatcher URINormalization Auth Bypass
CVE-2026-15573
8.1 - High
- August 05, 2026
A flaw was found in Keycloak's Authorization Services. The component responsible for matching request paths to security policies (PathMatcher) does not properly normalize URIs before comparison. By adding extra characters like a trailing slash or matrix parameters to a URL, an attacker can trick the system into applying a less restrictive security policy than intended. This allows an authenticated user to access administrative or restricted areas they should not have permission to see.
Improper Handling of Case Sensitivity
Red Hat Keycloak Services SAML Meta Import flaw: Signature Bypass
CVE-2026-16443
7.4 - High
- August 05, 2026
A flaw was found in the SAML metadata import functionality of the keycloak-services component, which is the core engine for identity brokering in Red Hat Build of Keycloak. When importing identity provider metadata that lacks specific usage attributes for keys, the system incorrectly disables signature validation for SAML responses even if a signing certificate is provided. This issue allows an unauthenticated attacker to forge a SAML response and gain unauthorized access to a user account by knowing their external identifier.
Improper Verification of Cryptographic Signature
Keycloak Backchannel Logout Flaw: SIGOmitted OIDC Logout
CVE-2026-18569
3.7 - Low
- August 04, 2026
A flaw was found in the backchannel logout endpoint of the keycloak-services component, which is part of the Red Hat Build of Keycloak. This component handles authentication and session management for applications. The issue occurs when an OIDC identity provider is configured to skip signature validation. In this specific setup, the system incorrectly accepts logout requests that have no cryptographic signature. An attacker who knows certain technical details about a user's session can use this flaw to force that user to be logged out, potentially disrupting their work.
Improper Verification of Cryptographic Signature
Path Traversal in WildFly Domain Mode via Slave-DC Protocol
CVE-2026-17614
4.4 - Medium
- August 04, 2026
A path traversal flaw was found in WildFly's domain mode implementation. The LocalFileRepository.getFile() and getConfigurationFile() methods in wildfly-core/deployment-repository do not validate that the resolved file path remains within the configured repository or configuration root directories. A remote attacker who has obtained the slave host controller secret or compromised a slave host controller can supply a crafted relative path containing directory traversal sequences (e.g., ../../etc/passwd) via the slave-DC wire protocol, causing the Domain Controller to resolve and serve arbitrary files readable by the DC process. This leads to unauthorized disclosure of sensitive information such as configuration files, keystores, and system credentials.
Directory traversal
Keycloak Services Bypass of Client Policies via Confidential Client Update
CVE-2026-18573
6.5 - Medium
- August 02, 2026
A flaw was found in the keycloak-services component of Keycloak, which is used for managing authentication and authorization flows. The issue occurs when a realm administrator configures client policies to enforce specific authentication requirements on confidential clients. Due to improper evaluation of the client state during an update operation, an attacker with client management permissions can bypass these security policies by first creating a public client and then updating it to a confidential client with weaker authentication. This can result in the persistence of clients that do not comply with the intended security hardening of the realm.
AuthZ
Keycloak Time Policy Bypass via Fake Time Claims
CVE-2026-18572
6.5 - Medium
- August 02, 2026
Keycloak provides authorization services that allow administrators to restrict access to resources based on time policies (for example, only allowing access during business hours). A flaw was discovered where a user can include a fake time value in their authorization request that overrides the actual server time. This allows the user to bypass these time-based restrictions and access protected resources at unauthorized times.
AuthZ
Keycloak: FGAP V2 Allows Unauthorized User Group Additions
CVE-2026-18571
6.6 - Medium
- August 02, 2026
A flaw was found in the user creation component of Keycloak when Fine-Grained Admin Permissions V2 (FGAP V2) is enabled. This issue allows a sub-administrator with permission to create users to add those users to any group, even groups the sub-administrator is not authorized to manage. This could lead to unauthorized access to sensitive information or elevated privileges for the newly created users.
AuthZ
Red Hat Keycloak FullScopeDisabled Executor Bypass
CVE-2026-18570
5.4 - Medium
- August 02, 2026
A flaw was found in the full-scope-disabled client-policy executor within the keycloak-services component. This component is responsible for enforcing security policies during client registration and configuration in Red Hat Build of Keycloak. The issue occurs because the executor only validates the fullScopeAllowed field when it is explicitly provided in a request. By omitting this field, a delegated user can bypass the policy, resulting in a client created with full scope access. This allows the client to obtain tokens with unauthorized role mappings.
AuthZ
Keycloak keycloak-services OIDC Param Poll. Reroute Enables Session Fix
CVE-2026-18209
3.4 - Low
- July 31, 2026
A flaw was found in the keycloak-services component of Keycloak, which handles OpenID Connect (OIDC) authentication flows. The issue occurs because the security check designed to prevent HTTP parameter pollution only inspects the query portion of a redirect URL and ignores the fragment portion. When a client is configured with a wildcard redirect URI, an attacker can use this to inject duplicate security parameters into the login response. If a client application is not configured correctly, it might trust the attacker's injected data instead of the real security information from Keycloak, leading to session fixation or account confusion.
Improper Validation of Consistency within Input
Keycloak keycloak-services Hostname Validation Flaw Enables Unauth Client Mod
CVE-2026-18206
3.7 - Low
- July 31, 2026
A flaw was found in the keycloak-services component of Keycloak, which provides identity and access management services. The issue occurs when a realm administrator uses a wildcard domain (like *.example.com) to restrict which hosts can register or update clients. Due to improper validation, the system accepts any hostname that ends with the specified domain suffix, even if it is not a legitimate subdomain. An attacker who can control the reverse DNS of their connection can bypass these host-based restrictions, potentially allowing unauthorized client modifications.
Improper Input Validation
Keycloak Token Exchange Bypass: Domain Restriction Lapse
CVE-2026-18214
6.8 - Medium
- July 31, 2026
Keycloak allows users to log in using Google accounts and can be configured to only allow users from specific Google Workspace domains. A flaw was found where the token exchange feature, which allows swapping a Google token for a Keycloak token, does not check these domain restrictions. This means an attacker with a valid Google account from a different domain could bypass the security check and gain access to the Keycloak realm.
AuthZ
Keycloak GPI Prefix Check IDOR Enables Admin Access
CVE-2026-18203
6.5 - Medium
- July 31, 2026
A flaw was found in the group policy evaluation logic of Keycloak, an identity and access management solution. When a group policy is set to extend permissions to child groups, the system incorrectly uses a simple text-based prefix check to verify group membership. This allows a user who belongs to a different group with a similar starting name to bypass security checks and gain unauthorized access to administrative functions or protected resources.
AuthZ
Keycloak secure-client-uris flaw bypasses redirect URI security
CVE-2026-18211
4.2 - Medium
- July 31, 2026
A flaw was found in the secure-client-uris client policy executor within Keycloak core services. This component is responsible for enforcing security requirements on client configurations, such as requiring encrypted connections for redirect URIs. Due to an improper check that only looks at the start of a web address rather than properly verifying the host, an attacker can bypass these security restrictions by using a specially crafted domain name. This could allow an attacker to intercept sensitive authentication codes over unencrypted connections.
Improper Input Validation
Unauthorized OIDC Introspection Exposure in Keycloak Services
CVE-2026-18208
6.5 - Medium
- July 31, 2026
A flaw was found in the OIDC token introspection endpoint of the keycloak-services component. Keycloak is an open-source identity and access management solution used to secure modern applications and services. The issue occurs when a confidential client, configured to receive signed JWT introspection responses, attempts to introspect a token issued for a different audience. Although the endpoint correctly identifies the token as inactive for that client, it still returns the full set of token claims within a signed JWT field. This allows an unauthorized client to bypass audience-based restrictions and access sensitive information contained in the token.
AuthZ
Keycloak RoleContainerResource Authorization Bypass in Admin REST API
CVE-2026-16105
4.9 - Medium
- July 31, 2026
A flaw was found in the RoleContainerResource component of Keycloak. The issue occurs because certain name-based endpoints in the admin REST API do not properly enforce authorization checks when managing composite roles. This allows a delegated administrator with manage-realm permissions to remove essential child roles from built-in admin roles, potentially disrupting administrative functions within a realm.
AuthZ
Keycloak Token Exchange Bypass Ignoring Org Restriction
CVE-2026-18215
6.8 - Medium
- July 31, 2026
Keycloak provides a way to let users log in using Microsoft accounts while restricting access to a specific organization (tenant). A flaw was discovered where this restriction is ignored when using the token exchange feature. This means an attacker with a valid Microsoft token from a completely different organization could gain access to the Keycloak realm, potentially accessing sensitive data or performing unauthorized actions.
authentification
Keycloak SAML Wildcard URL Injection (CVE-2026-18217)
CVE-2026-18217
3.4 - Low
- July 31, 2026
A flaw was found in the SAML protocol implementation of Keycloak, an open-source identity and access management solution. The issue occurs when Keycloak handles SAML authentication requests using the HTTP-Redirect binding. If a client is configured with a wildcard redirect URL, an attacker can craft a request that includes malicious parameters. When a user authenticates, Keycloak appends its legitimate response to the attacker's parameters. This can cause some service providers to process the attacker's data instead of the real login information, potentially leading to a user being logged into the wrong account.
Improper Input Validation
TokenManager revocation bypass in Keycloak
CVE-2026-18218
4.2 - Medium
- July 31, 2026
A flaw was found in the TokenManager component of the Keycloak identity management service. When an administrator attempts to revoke tokens for a specific application (client) using a "not-before" policy, the revocation may be silently ignored if the overall security realm already has an older, non-zero revocation policy in place. This issue can allow previously issued tokens to remain valid for refreshing sessions and accessing user information even after an administrator has attempted to invalidate them.
AuthZ
Keycloak Admin API Allows Identity Provider Linking Without Org Admin Privileges
CVE-2026-18201
5.5 - Medium
- July 29, 2026
Keycloak provides a way to manage identity providers and organizations through its administrative API. A flaw was discovered where an administrator with permission to manage identity providers could link a new provider to an organization without having the required permissions to manage that organization. This could allow an unauthorized administrator to influence how users log into specific organizations.
AuthZ
Keycloak Client Policy Bypass via Group Name Match
CVE-2026-18207
6.5 - Medium
- July 29, 2026
A flaw was found in the client policy enforcement mechanism of Keycloak. The issue occurs when the system checks group membership by name instead of a unique identifier. An attacker with client management privileges could bypass security policies by joining a group with a matching name in a different part of the group hierarchy, potentially allowing them to register or update clients without following required security hardening profiles.
AuthZ
Keycloak role-users endpoint leaks user info due to missing admin permission
CVE-2026-17059
6.5 - Medium
- July 24, 2026
A flaw was found in the role-users endpoint of the keycloak-services library, which is the core component of the Keycloak identity and access management solution. The issue occurs because the system fails to check if an administrator has permission to view individual users when listing members of a role. This allows a restricted administrator to see private information, such as names and email addresses, for users they should not be able to access.
Insecure Direct Object Reference / IDOR
Keycloak Admin REST API: View-Only Admins Can Leak Client Secrets
CVE-2026-17048
5.5 - Medium
- July 24, 2026
A flaw was found in the Keycloak Admin REST API, which is used to manage security realms and clients. The issue occurs when the system processes requests for rotated client secrets that are stored in a secure vault. Due to improper boundary enforcement, a delegated administrator with view-only permissions can retrieve the actual resolved secret instead of the vault placeholder, leading to the exposure of sensitive credentials.
Information Disclosure
KeycloakServices auth endpoint leaks recaptcha keys via config VIEW only
CVE-2026-16104
4.3 - Medium
- July 17, 2026
A flaw was found in the authentication configuration endpoint of the keycloak-services component, which is the core engine for Red Hat Build of Keycloak identity and access management. The issue occurs because the system fails to mask sensitive configuration values, such as reCAPTCHA secret keys, when they are requested by administrators with view-only permissions. This can lead to the exposure of third-party service credentials to unauthorized personnel or through administrative logs.
Insufficiently Protected Credentials
Brute-Force Token Redemption Loophole in Keycloak CIBA (keycloak-services)
CVE-2026-16103
4.3 - Medium
- July 17, 2026
A flaw was found in the keycloak-services component of Keycloak. This issue is an incomplete fix for CVE-2026-9798, where brute-force protection checks were added to the Client-Initiated Backchannel Authentication (CIBA) initiation handler but were omitted from the token redemption handler. This allows an attacker with valid client credentials to obtain access and refresh tokens for a user account that has been locked due to brute-force protection, provided the authentication request was started before the lockout occurred and was approved by the user.
Improper Enforcement of Behavioral Workflow
Keycloak Admin API: RBAC Bypass Removing Composite Roles
CVE-2026-16106
4.9 - Medium
- July 17, 2026
A flaw was found in the admin REST API of Keycloak, a solution for identity and access management. The issue occurs when a delegated administrator attempts to remove a child role from a composite role. Due to missing authorization checks, an attacker with limited administrative permissions can remove privileged roles they are not authorized to manage, leading to a loss of access for other users and administrators.
AuthZ
Keycloak Default-Group Disclosure via Delegated Admin
CVE-2026-16108
4.3 - Medium
- July 17, 2026
A flaw was found in the default-groups REST endpoint and realm representation of Keycloak. This component is responsible for managing groups that are automatically assigned to new users within a realm. The issue allows a delegated administrator with realm-viewing permissions to see the names and identifiers of hidden default groups, even if they lack the specific permissions to view those groups. This can lead to the exposure of sensitive organizational structures or internal group names.
Information Disclosure
Bypass Keycloak Client Policies Signed JWT Enforcement
CVE-2026-16093
5.4 - Medium
- July 17, 2026
Keycloak provides a mechanism called Client Policies to enforce security requirements on clients, such as requiring them to use signed JWTs for authentication. A flaw was discovered where this enforcement can be bypassed. An attacker with valid client credentials can provide a fake, unsigned assertion header that tricks the system into thinking the policy requirements have been met. This allows the attacker to authenticate using simpler methods like a client secret even when the administrator has mandated more secure, signed assertions.
Reliance on Untrusted Inputs in a Security Decision
Stay on top of Security Vulnerabilities
Want an email whenever new vulnerabilities are published for Red Hat Jbosseapxp or by Red Hat? Click the Watch button to subscribe.
