Known vulnerabilities in Red Hat build of Keycloak 26.4.1

Vendor: Red Hat Inc.
Software: Red Hat build of Keycloak
Version: 26.4.1
Software CPE: cpe:2.3:a:red_hat:red_hat_build_of_keycloak:*:*:*:*:*:*:*:*
Website: https://www.redhat.com/en
Total vulnerabilities: 42
Public exploits: 0
Known exploited (KEV): 0
Highest CVSSv4 Score: 9.2

Vulnerabilities by Severity

Severity distribution of vulnerabilities affecting Red Hat build of Keycloak version 26.4.1 Red Hat build of Keycloak 26.4.1 is affected by 42 vulnerabilities: 13 medium, 29 low Critical High Medium Low

Vulnerabilities (42)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU148980 - Allocation of Resources Without Limits or Throttling
CVE-2026-6860		 CWE-770 Medium
No
No
 26.4.13, 26.6.4 11.09.2026 SB2026091123
SB2026091128
#VU146997 - Missing Authorization
CVE-2026-9088		 CWE-862 Low
No
No
 26.4.13, 26.6.3 05.09.2026 SB2026090517
SB2026091122
SB2026091128
#VU146996 - Improper Handling of Insufficient Permissions or Privileges
CVE-2026-9792		 CWE-280 Medium
No
No
 26.4.13, 26.6.3 05.09.2026 SB2026090517
SB2026091122
SB2026091128
#VU146995 - Improper Validation of Specified Quantity in Input
CVE-2026-9704		 CWE-1284 Low
No
No
 26.4.13, 26.6.3 05.09.2026 SB2026090517
SB2026091122
SB2026091128
#VU146994 - Improper Validation of Specified Quantity in Input
CVE-2026-9801		 CWE-1284 Low
No
No
 26.4.13, 26.6.3 05.09.2026 SB2026090517
SB2026091122
SB2026091128
#VU146992 - Incorrect Authorization
CVE-2026-9791		 CWE-863 Low
No
No
 26.4.13, 26.6.3 05.09.2026 SB2026090517
SB2026091122
SB2026091128
#VU146991 - Insufficient Session Expiration
CVE-2026-9802		 CWE-613 Medium
No
No
 26.4.13, 26.6.3 05.09.2026 SB2026090517
SB2026091122
SB2026091128
#VU146990 - Authorization Bypass Through User-Controlled Key
CVE-2026-9087		 CWE-639 Low
No
No
 26.4.13, 26.6.3 05.09.2026 SB2026090517
SB2026091122
SB2026091128
#VU146989 - Use of Client-Side Authentication
CVE-2026-8830		 CWE-603 Low
No
No
 26.4.13, 26.6.3 05.09.2026 SB2026090517
SB2026091122
SB2026091128
#VU146988 - Incorrect Implementation of Authentication Algorithm
CVE-2026-8922		 CWE-303 Low
No
No
 26.4.13, 26.6.3 05.09.2026 SB2026090517
SB2026091122
SB2026091128
#VU146987 - Direct Request ('Forced Browsing')
CVE-2026-7500		 CWE-425 Medium
No
No
 26.4.13, 26.6.3 05.09.2026 SB2026090517
SB2026091122
SB2026091128
#VU146986 - Improper input validation
CVE-2026-37977		 CWE-20 Low
No
No
 26.4.13, 26.6.3 05.09.2026 SB2026090517
SB2026091122
SB2026091128
#VU146985 - Server-Side Request Forgery (SSRF)
CVE-2026-4874		 CWE-918 Low
No
No
 26.4.13, 26.6.3 05.09.2026 SB2026090517
SB2026091122
SB2026091128
#VU146983 - Information Exposure Through an Error Message
CVE-2026-9794		 CWE-209 Medium
No
No
 26.4.13, 26.6.3 01.07.2026 SB2026090517
SB2026091122
SB2026091128
#VU135697 - Authorization Bypass Through User-Controlled Key
CVE-2026-9099		 CWE-639 Low
No
No
 26.4.13, 26.6.4 29.06.2026 SB2026062907
SB2026091128
#VU135696 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2026-9083		 CWE-22 Low
No
No
 26.4.13, 26.6.4 29.06.2026 SB2026062907
SB2026091128
#VU135693 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-9086		 CWE-79 Low
No
No
 26.4.13, 26.6.4 29.06.2026 SB2026062907
SB2026091128
#VU135691 - Incorrect Privilege Assignment
CVE-2026-9795		 CWE-266 Low
No
No
 26.4.13, 26.6.4 29.06.2026 SB2026062907
SB2026091128
#VU135690 - Authorization Bypass Through User-Controlled Key
CVE-2026-9799		 CWE-639 Low
No
No
 26.4.13, 26.6.4 29.06.2026 SB2026062907
SB2026091128
#VU135688 - Comparison using wrong factors
CVE-2026-9800		 CWE-1025 Medium
No
No
 26.4.13, 26.6.4 29.06.2026 SB2025031143
SB2026083155
SB2026083156
and 1 more


Showing elements 1 - 20 out of 42