Red Hat Single Sign On Red Hat Single Sign On

  1. Vendors
  2. Red Hat
  3. Red Hat Single Sign On

Don't miss out!

Thousands of developers use stack.watch to stay informed.
Get an email whenever new security vulnerabilities are reported in Red Hat Single Sign On.

By the Year

In 2026 there have been 185 vulnerabilities in Red Hat Single Sign On with an average score of 6.7 out of ten. Last year, in 2025 Red Hat Single Sign On had 11 security vulnerabilities published. That is, 174 more vulnerabilities have already been reported in 2026 as compared to last year. However, the average CVE base score of the vulnerabilities in 2026 is greater by 0.35.




Year Vulnerabilities Average Score
2026 185 6.71
2025 11 6.35
2024 30 6.38
2023 5 5.76

It may take a day or so for new Red Hat Single Sign On vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.

Recent Red Hat Single Sign On Security Vulnerabilities

Keycloak FGAP v2 PrivEsc via Composite Role Leak
CVE-2026-96448 6.6 - Medium - September 25, 2026

A flaw was found in the Fine-Grained Admin Permissions (FGAP v2) feature of Keycloak, an identity and access management solution. The issue occurs when the system checks if a delegated administrator has permission to assign a specific role to a user. Because the check does not look inside composite roles to see what other permissions they contain, an administrator with limited rights can assign a role that secretly includes full administrative control. This allows the attacker to gain complete management access over the entire realm.

AuthZ

Keycloak STX v2 Bypass mTLS HoK Binding for Token Use
CVE-2026-97846 6.8 - Medium - September 25, 2026

Keycloak provides a feature called mTLS holder-of-key binding which ensures that a token can only be used by the client that originally requested it by binding it to their digital certificate. A flaw was discovered where the new Standard Token Exchange V2 feature does not check for this certificate. This allows an attacker with stolen client credentials to obtain a standard, unrestricted token that bypasses these security protections.

authentification

Keycloak Admin REST API Bypass Group Visibility Permissions
CVE-2026-97311 4.3 - Medium - September 24, 2026

A flaw was found in the Admin REST API of Keycloak, an identity and access management solution. The endpoints used to retrieve groups associated with a specific role do not properly check for individual group visibility permissions. This allows a delegated administrator with basic search privileges to view detailed information about all groups assigned to a role, bypassing intended security restrictions that should limit their view to specific groups.

AuthZ

Keycloak Admin REST API Password Reset Bypass via User Update
CVE-2026-97177 6.6 - Medium - September 24, 2026

A flaw was found in the user update mechanism of the Keycloak Admin REST API. When Fine-Grained Admin Permissions are enabled, the system fails to check for specific password reset authorizations during a general user profile update. This allows a delegated administrator, who should be restricted from resetting passwords, to change a user's credentials and take over their account.

AuthZ

Keycloak Auth Level Enforcement Bypass
CVE-2026-97176 4.2 - Medium - September 24, 2026

A flaw was found in the Level of Authentication enforcement mechanism of Keycloak, an identity and access management solution. The issue occurs when a client specifically requires a higher security level for a user who already has an active session at a lower level. Due to a logic error in how session re-evaluations are handled, Keycloak may incorrectly issue a token at the lower security level instead of enforcing the required higher level, potentially allowing unauthorized access to sensitive resources that rely on these security claims.

AuthZ

A flaw was found in the Conditional OTP authenticator of Keycloak, an identity and access management solution
CVE-2026-96445 6.8 - Medium - September 23, 2026

A flaw was found in the Conditional OTP authenticator of Keycloak, an identity and access management solution. The issue occurs when the system evaluates specific HTTP headers to determine if a one-time password (OTP) should be skipped, but fails to verify if those headers came from a trusted source. This could allow an attacker who already has a user's password to bypass the second-factor authentication by providing a specially crafted header in their request.

authentification

A flaw was found in the Pushed Authorization Request PAR implementation of Keycloak
CVE-2026-96446 4.2 - Medium - September 23, 2026

A flaw was found in the Pushed Authorization Request PAR implementation of Keycloak. The issue occurs when the silent authentication path prompt=none is used, which allows the authorization process to skip certain steps if a user is already logged in. Due to this bypass, the security rule that ensures a pushed request URI is used only once is not enforced. An attacker could potentially reuse a request URI to obtain multiple authorization codes for a user who is already signed in, violating security standards like FAPI-2.

AuthZ

KDC Spoofing in Keycloak Kerberos Federation (Authentication Bypass)
CVE-2026-95503 6.8 - Medium - September 22, 2026

A flaw was found in the Kerberos federation provider of Keycloak, an open-source identity and access management solution. When Kerberos password authentication is used without SPNEGO, the system fails to verify the identity of the Key Distribution Center (KDC) by requesting a server ticket. This allows an attacker on the same network to spoof the KDC and bypass the authentication process, potentially gaining unauthorized access to user accounts.

Improper Verification of Cryptographic Signature

Keycloak Auth Session Flaw: 2FA Bypass via Session Restart Link
CVE-2026-94218 3.1 - Low - September 21, 2026

A flaw was found in the authentication session management of Keycloak, an identity and access management solution. The issue occurs when an administrator enforces a stronger authentication flow, such as mandatory two-factor authentication (2FA) setup, through a client policy. A user can bypass this requirement by manually visiting a specific session restart web link during the login process. This action clears the internal markers that track the required security steps, allowing the user to log in with only a password and gain access without completing the mandated 2FA setup.

AuthZ

Keycloak UMA Permission Ticket Merging (CVE-2026-94217)
CVE-2026-94217 3.5 - Low - September 21, 2026

A flaw was found in the User-Managed Access (UMA) implementation of Keycloak. The issue occurs in the authorization token endpoint when processing permission tickets. If two different users own resources with the same name, the system incorrectly merges the permissions from both resources when one user requests an authorization token. This allows an attacker to gain access scopes on a victim's resource that were never intended to be shared.

AuthZ

Keycloak Admin REST API Privilege Escalation via Realm Validation Bypass
CVE-2026-94215 5.5 - Medium - September 21, 2026

A flaw was found in the Admin REST API of Keycloak, an open-source identity and access management solution. The issue occurs because the API uses a per-request in-memory cache to resolve clients by their unique identifier without verifying if the client belongs to the realm specified in the request path. This allows an administrator with limited privileges to read or modify sensitive client configurations in the master realm by accessing them through a realm they control. Successful exploitation could lead to the exposure of client credentials or the redirection of administrative login attempts to malicious sites.

AuthZ

Keycloak Auth Services: Admin Bypass Reveals Full User Profiles
CVE-2026-94213 4.9 - Medium - September 21, 2026

A flaw was found in the Authorization Services component of Keycloak, an open-source identity and access management solution. The issue occurs in the policy evaluation endpoint, which is used by administrators to test how access policies apply to specific users. Due to missing authorization checks, a delegated administrator with limited viewing privileges can access the full profile and role information of any user in the realm, even if they are not permitted to view user details. This could lead to the exposure of sensitive information such as email addresses and assigned security roles.

AuthZ

Keycloak Admin REST API DeleteCred PrivEsc for Delegated Admin
CVE-2026-94001 6.5 - Medium - September 19, 2026

A flaw was found in the Admin REST API of Keycloak, an open-source identity and access management solution. The endpoint used for deleting user credentials does not correctly check for fine-grained reset-password permissions. This allows a delegated administrator, who should be restricted from resetting passwords, to delete a user's password credentials, resulting in the user being unable to log in.

AuthZ

Privilege Escalation via Keycloak Admin REST Group-Membership API
CVE-2026-94000 6.6 - Medium - September 19, 2026

A flaw was found in the Admin REST API of Keycloak, an open-source identity and access management solution. The issue occurs in the group-membership endpoints where the system fails to check if a group grants administrative privileges before allowing a user to be added. This allows a delegated administrator with limited permissions to add themselves to a high-privilege group, potentially gaining full control over the entire realm.

AuthZ

Keycloak OIDC Token Refresh Bypass for Disabled Clients
CVE-2026-93999 4.2 - Medium - September 19, 2026

A flaw was found in the OIDC protocol implementation of Keycloak, an open-source identity and access management solution. The issue occurs during the token refresh process when the server restores requested audiences from stored client IDs. Keycloak fails to verify if the target audience client is still enabled before issuing a new access token. This allows an application with an existing refresh token to continue obtaining valid access tokens for a disabled client, potentially bypassing administrative access controls for resource servers that rely on offline JWT validation.

AuthZ

Netty HTTP/1 Decoder Request Smuggling via Malformed Transfer-Encoding
CVE-2026-93562 6.5 - Medium - September 18, 2026

A flaw was found in Netty's HTTP/1 decoder. Incomplete validation of malformed Transfer-Encoding headers allows a remote attacker to perform HTTP request smuggling. By sending specially crafted HTTP requests, an attacker can inject arbitrary HTTP requests, potentially bypassing security controls or accessing unauthorized resources.

OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities

Netty netty-codec-http HTTP Smuggling via Chunk-Size Post-Digit Whitespace
CVE-2026-93574 6.5 - Medium - September 18, 2026

A flaw was found in Netty's `netty-codec-http` component. A remote attacker could exploit this vulnerability by sending a specially crafted HTTP/1.1 chunk-size token that includes post-digit whitespace. This incorrect parsing of the chunk size can lead to HTTP request smuggling. This allows an attacker to bypass security controls or access unauthorized resources in proxy/backend deployments.

HTTP Request Smuggling

Netty HTTP/2 Header Field Injection Vulnerability (CVE-2026-93579)
CVE-2026-93579 6.5 - Medium - September 18, 2026

A flaw was found in Netty's HTTP/2 stack. This vulnerability allows a remote attacker to inject prohibited characters, such as NUL, Line Feed, and Carriage Return, into HTTP/2 header field values due to insufficient validation. When these values cross an HTTP/2 to HTTP/1.1 translation boundary, they can be exploited for request smuggling, header injection, or response splitting. This could lead to unauthorized access, data manipulation, or other security bypasses.

OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities

Netty Transfer-Encoding Field Split Bypass Enables Request Smuggling
CVE-2026-93573 6.5 - Medium - September 18, 2026

A flaw was found in Netty's HTTP/1.1 decoder. This vulnerability allows a remote attacker to bypass `Transfer-Encoding` header validation by splitting the `Transfer-Encoding` field across multiple headers, with the last field containing a non-final transfer coding like `gzip` or `deflate`. This bypass can lead to HTTP request smuggling, enabling attackers to bypass security controls, desynchronize request processing, or cause requests to be processed in an unintended context.

HTTP Request Smuggling

Red Hat: HTTP/2/3 EXT CONNECT Downgrade in Apache HTTPd
CVE-2026-93568 7.5 - High - September 18, 2026

A flaw was found in Netty. A remote attacker could exploit this vulnerability by sending specially crafted HTTP/2 or HTTP/3 Extended CONNECT requests. Netty's HTTP-object conversion path incorrectly processes these requests as regular HTTP/1.1 CONNECT requests, leading to a loss of critical protocol and path information. This misinterpretation can allow attackers to bypass security policies, such as routing or authorization logic, in applications that rely on Netty for HTTP/2 or HTTP/3 communication, resulting in integrity loss.

Improper Input Validation

Netty netty-codec-smtp SMTP cmd-name not CRLF-validated Vulnerability
CVE-2026-93576 7.5 - High - September 18, 2026

A flaw was found in Netty netty-codec-smtp. The component does not properly validate Carriage Return (CR) and Line Feed (LF) characters in the SMTP command-name field. A remote attacker, if an application routes untrusted input into this field, can embed CR/LF characters to inject arbitrary SMTP commands. This can lead to SMTP command smuggling, allowing for unauthorized email relay or spoofing of sender/recipient addresses. While the impact is significant, the real-world exploitability is considered lower as applications typically do not place user-controlled data in the command-name field.

CRLF Injection

EAP Elytron Token-Realm OAuth2 Introspection URL Encoding Flaw
CVE-2026-85511 4.2 - Medium - September 18, 2026

A flaw was found in EAP's Elytron. An EAP application whose security domain is backed by an Elytron token-realm with oauth2-introspection would allow parameter substitution due to missing URL encoding.

Authentication Bypass by Spoofing

Netty HTTP/1HTTP/2 Host Header Conflict Allows Unauthorized Access
CVE-2026-93569 8.2 - High - September 18, 2026

A flaw was found in Netty. A remote unauthenticated attacker can exploit a vulnerability in Netty's HTTP/1 to HTTP/2 conversion process. When an HTTP/1 request includes both an absolute-form request-target and a conflicting Host header, Netty incorrectly prioritizes the Host header for the HTTP/2 :authority field, discarding the original request-target authority. This inconsistency can allow an attacker to bypass security controls in Netty-based proxies or gateways, potentially leading to unauthorized access, cache poisoning, or misrouting of requests.

HTTP Request Smuggling

Netty HTTP/2 CONNECT Host Header Exploit Bypass Tunnel Allow-List
CVE-2026-93567 7.5 - High - September 18, 2026

A flaw was found in Netty's HTTP/2 codec. When converting HTTP/1 CONNECT requests to HTTP/2, the component incorrectly uses the Host header instead of the CONNECT authority-form request-target for the tunnel authority. A remote attacker can exploit this by supplying a different Host header, leading to a malformed HTTP/2 CONNECT request. This can bypass security controls such as tunnel allow-lists or egress policies, resulting in integrity loss.

Improper Input Validation

WildFly Elytron ASN1 DERDecoder DoS via Excessive Memory Allocation
CVE-2026-10832 5.9 - Medium - September 18, 2026

A flaw was found in the DERDecoder class within wildfly-elytron-asn1. A remote attacker can exploit this resource exhaustion vulnerability by sending a specially crafted DER (Distinguished Encoding Rules) payload. The decoder attempts to allocate excessive memory based on an inflated length value without proper validation, leading to Java Virtual Machine (JVM) memory exhaustion. This results in a remote Denial of Service (DoS) for services that process untrusted DER/ASN.1 input, including SASL (Simple Authentication and Security Layer) authentication mechanisms and X.500 certificate principal parsing paths.

Allocation of Resources Without Limits or Throttling

Netty HTTP Request Smuggling via Chunk-Size Line Bypass
CVE-2026-93566 6.5 - Medium - September 18, 2026

A flaw was found in Netty. A remote attacker could exploit this by sending a specially crafted HTTP request that includes control characters within the chunk-size line. This bypasses the intended strict validation, allowing the attacker to inject arbitrary HTTP requests. This vulnerability can lead to HTTP request smuggling, potentially resulting in information disclosure or other unauthorized actions.

OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities

Netty RtspDecoder Method-Token Smuggling via RTSP Request
CVE-2026-93565 7.5 - High - September 18, 2026

A flaw was found in Netty RtspDecoder. The `RtspMethods.valueOf()` function incorrectly strips trailing control bytes from method tokens in Real-Time Streaming Protocol (RTSP) requests. A remote attacker can exploit this by sending a specially crafted RTSP request, leading to method-token smuggling. This vulnerability allows an attacker to bypass method-based access controls and can also be used to launder malicious requests through Netty-based RTSP proxies, making them appear legitimate to backend systems.

OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities

Netty HAProxy PROXY-v2 RefCnt Leak: Remote DoS
CVE-2026-93564 7.5 - High - September 18, 2026

A flaw was found in Netty. A reference-count leak in the HAProxy PROXY-v2 message decoder allows a remote, unauthenticated attacker to send specially crafted PROXY-protocol v2 headers. This can lead to memory exhaustion, resulting in a Denial of Service (DoS) for the affected system.

OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities

Netty WebSocketServerExtensionHandler DoS via HTTP/1.1 Pipelining Queue Overflow
CVE-2026-93558 7.5 - High - September 18, 2026

A flaw was found in Netty's WebSocketServerExtensionHandler. A remote, unauthenticated attacker can exploit this vulnerability by using HTTP/1.1 pipelining to send requests faster than the application can respond. This leads to an unbounded growth of a per-connection queue, consuming excessive memory. Eventually, this can cause the Java Virtual Machine (JVM) to exhaust its heap, resulting in a Denial of Service (DoS) for the affected server.

OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities

Netty STOMP codec int truncation can cause DoS
CVE-2026-93560 7.5 - High - September 18, 2026

A flaw was found in the Netty STOMP codec. A remote attacker could send a specially crafted STOMP frame with a content-length header exceeding the maximum integer value. This integer truncation vulnerability could lead to an infinite decode loop, causing a Denial of Service (DoS) by exhausting memory and CPU resources.

OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities

Netty HpackEncoder DoS via oversized SETTINGS MAX_HEADER_TABLE_SIZE
CVE-2026-93492 5.3 - Medium - September 18, 2026

A flaw was found in Netty's HTTP/2 HpackEncoder. A remote attacker can exploit this by sending HTTP/2 SETTINGS frames with a very large MAX_HEADER_TABLE_SIZE. This causes the HpackEncoder to store an excessive number of unique headers, leading to increased CPU usage and memory consumption, ultimately resulting in a Denial of Service (DoS).

OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities

Netty HttpServerCodec DoS via HTTP/1.1 pipelining (before 4.2)
CVE-2026-93491 7.5 - High - September 18, 2026

A flaw was found in Netty's HttpServerCodec. A remote, unauthenticated attacker can exploit this vulnerability by pipelining HTTP/1.1 requests on a single connection and withholding reads. This action causes the methodOverflowQueue to grow without limit, leading to unbounded heap memory consumption and a denial of service due to memory exhaustion.

Allocation of Resources Without Limits or Throttling

Netty SpdySessionHandler Unbounded Streams DoS
CVE-2026-93488 7.5 - High - September 18, 2026

A flaw was found in Netty. SpdySessionHandler accepts an unlimited number of concurrent remote-initiated streams because localConcurrentStreams defaults to Integer.MAX_VALUE and the handler provides no API to change it. A remote peer can open a SPDY connection and send a large number of SYN_STREAM frames with FLAG_FIN=0, causing unbounded heap and direct memory allocation that can lead to JVM OutOfMemoryError and a denial of service.

Allocation of Resources Without Limits or Throttling

MemEx DoS via Unbounded Multi-line Response in SmtpResponseDecoder (Apache MINA)
CVE-2026-93563 7.5 - High - September 18, 2026

A flaw was found in Netty's `SmtpResponseDecoder` component. A remote attacker, acting as a malicious or man-in-the-middle (MITM) SMTP server, could exploit this by sending a specially crafted, unbounded multi-line SMTP response without a terminator. This vulnerability leads to unbounded memory accumulation within the client's Java Virtual Machine (JVM) heap, causing an `OutOfMemoryError` and a denial of service (DoS) due to a process crash.

OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities

Redisson Java Client Resource Exhaustion via Nested RESP Arrays
CVE-2026-93572 7.5 - High - September 18, 2026

A flaw was found in Netty's `RedisArrayAggregator` component. A remote attacker can exploit this vulnerability by sending specially crafted nested Redis (RESP) array headers. This can cause the `RedisArrayAggregator` to eagerly preallocate a large amount of heap memory, leading to heap memory exhaustion and a Denial of Service (DoS) for applications using `RedisDecoder` with `RedisArrayAggregator` on untrusted traffic.

Allocation of Resources Without Limits or Throttling

Netty MQTT Decoder DoS via Property Length Exploit
CVE-2026-93575 7.5 - High - September 18, 2026

A flaw was found in Netty's MqttDecoder. An unauthenticated remote attacker can exploit this vulnerability by sending a specially crafted MQTT CONNECT packet. The decoder fails to properly validate the 'Properties Length' against the 'Remaining Length', allowing an attacker to bypass size limits. This leads to excessive memory and CPU consumption, resulting in a denial of service (DoS) due to an OutOfMemoryError.

OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities

RedHat Memcached Binary Codec Signed/Unsigned Type Mismatch Desynchronizes Frame
CVE-2026-93561 6.5 - Medium - September 18, 2026

A flaw was found in io.netty/netty-codec-memcache. The Memcache binary protocol codec incorrectly reads `keyLength` and `extrasLength` as signed Java types instead of unsigned, as specified by the protocol. A malicious Memcache server can exploit this type mismatch by sending a specially crafted response. This can lead to frame desynchronization and response smuggling, where one client's data may be inadvertently exposed to another client's response stream in proxy or cache environments.

OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities

Netty StompSubframeDecoder Memory Leak DoS via Missing Null Terminator
CVE-2026-93494 7.5 - High - September 18, 2026

A flaw was found in Netty's StompSubframeDecoder component. A remote attacker can exploit this vulnerability by sending a specially crafted STOMP frame body without its terminating null byte. This causes the decoder to allocate a ByteBuf (a buffer for bytes) that is never released, leading to a permanent memory leak. Over time, this uncontrolled memory consumption can result in a Denial of Service (DoS) for the application using the affected STOMP codec.

OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities

RESTEasy CorsFilter CORS Misconfig Enables Credentialed CrossOrigin Access
CVE-2026-89058 7.4 - High - September 18, 2026

A flaw was found in RESTEasy's CorsFilter, which, when configured to allow all origins ("*"), reflects the request's Origin header back in the Access-Control-Allow-Origin response together with Access-Control-Allow-Credentials: true. This permissive cross-origin policy allows a malicious website to make credentialed cross-origin requests and read authenticated responses from a victim's session, resulting in a loss of confidentiality.

Permissive Cross-domain Policy with Untrusted Domains

RESTEasy IIOImageProv Unbounded Image Dimension DoS
CVE-2026-89059 7.5 - High - September 18, 2026

A flaw was found in RESTEasy's IIOImageProvider, which decodes attacker-supplied image request bodies without enforcing any limit on the declared image dimensions or pixel count. A remote, unauthenticated attacker can send a small crafted image declaring enormous dimensions to trigger a very large memory allocation, exhausting the JVM heap and resulting in a denial of service.

Data Amplification

A flaw was found in the first-broker-login flow of the keycloak-services component
CVE-2026-19607 5.3 - Medium - September 16, 2026

A flaw was found in the first-broker-login flow of the keycloak-services component. This component handles the initial authentication and account linking when a user logs in via an external identity provider. The issue allows an attacker to register a matching username on an external provider to trigger a collision in Keycloak, which results in the legitimate user being locked out of their account.

authentification

Keycloak is an open-source identity and access management solution
CVE-2026-17526 7.2 - High - September 16, 2026

Keycloak is an open-source identity and access management solution. A vulnerability was discovered where a user with the impersonation role can impersonate a realm administrator. This allows the attacker to gain full administrative control over the realm, including the ability to manage users, clients, and roles.

AuthZ

A flaw was found in the theme localization endpoints of the keycloak-services component
CVE-2026-79651 7.5 - High - September 16, 2026

A flaw was found in the theme localization endpoints of the keycloak-services component, which is the core service responsible for authentication flows and theme management in Keycloak. The issue occurs because the system accepts arbitrary locale tags from unauthenticated requests and stores them in a permanent in-memory cache without limits. An attacker can exploit this by sending a large number of unique locale tags, eventually causing the server to run out of memory and crash.

Resource Exhaustion

Keycloak provides a policy enforcer to protect applications by matching incoming web requests against defined security policies
CVE-2026-74909 8.1 - High - September 16, 2026

Keycloak provides a policy enforcer to protect applications by matching incoming web requests against defined security policies. A flaw was found where the enforcer fails to correctly normalize web addresses that contain special encoded characters, such as those representing semicolons or directory traversal segments. An authenticated user can use these encoded characters to trick the enforcer into applying a less restrictive security policy than intended, potentially gaining unauthorized access to sensitive administrative or private application endpoints.

AuthZ

A flaw was found in the SAML Redirect Binding implementation of Keycloak, an open-source identity and access management solution
CVE-2026-18212 7.5 - High - September 16, 2026

A flaw was found in the SAML Redirect Binding implementation of Keycloak, an open-source identity and access management solution. The issue occurs because the custom DEFLATE compression and decompression helpers fail to release native zlib memory after use. An unauthenticated attacker can exploit this by sending repeated malformed SAML requests, leading to native memory exhaustion and a denial of service.

Memory Leak

A flaw was found in the first broker login flow of Keycloak
CVE-2026-92358 6.4 - Medium - September 16, 2026

A flaw was found in the first broker login flow of Keycloak. When a user confirms an account-linking request from a different browser, a temporary proof is created to validate the link. However, this proof is not properly cleared after the link is established or when the user later manually removes the link. An attacker who controls the external identity can exploit this leftover proof to silently re-establish the link and gain unauthorized access to the victims account without any further confirmation.

Insufficient Session Expiration

Keycloak DCR Service Leak: Admin Role Reveals Client Secret
CVE-2026-89298 4.9 - Medium - September 11, 2026

A flaw was found in the Dynamic Client Registration service of Keycloak, an open-source identity and access management solution. The issue occurs when a user with the view-clients role accesses the client registration endpoint to retrieve client details. Due to a failure to mask sensitive information, the service returns the client's confidential secret in cleartext. This could allow a read-only administrator to obtain full access to the affected client's account and potentially escalate their privileges within the realm.

Information Disclosure

Keycloak Device Auth Grant Brute-Force Bypass for Locked Accounts
CVE-2026-88770 6.5 - Medium - September 10, 2026

A flaw was found in the Device Authorization Grant flow of Keycloak, an identity and access management solution. The issue occurs because the token redemption process fails to check if a user account is currently locked due to brute-force protection. If an attacker has an active session for a locked account, they can complete the device login process and receive new security tokens. This allows the attacker to maintain access to the account even when it should be temporarily disabled to prevent unauthorized entry.

Improper Restriction of Excessive Authentication Attempts

Keycloak Services Path Probing Flaw Allows File System Disclosure
CVE-2026-19729 4.9 - Medium - September 09, 2026

A flaw was found in the key provider component of the keycloak-services library, which is the core engine for the Red Hat Build of Keycloak. The issue occurs because a previous fix for path probing was incomplete, allowing a realm administrator to still submit arbitrary filesystem paths as keystore parameters. This can be used to determine the existence and readability of files on the server, potentially exposing sensitive system information.

Directory traversal

Keycloak first-broker-login flow allows social ID hijacking
CVE-2026-82968 6.4 - Medium - September 02, 2026

A flaw was found in the first-broker-login flow of the Keycloak identity management service. When a user links a social identity provider account to their local account, the verification proof generated is not strictly bound to the specific upstream identity being verified. This allows an attacker with a different account on the same social provider to intercept the process and link their own account to the victim's local profile, gaining unauthorized access.

Insecure Direct Object Reference / IDOR

Stay on top of Security Vulnerabilities

Want an email whenever new vulnerabilities are published for Red Hat Single Sign On or by Red Hat? Click the Watch button to subscribe.

Red Hat
Vendor

Red Hat Single Sign On
Product

subscribe