Keycloak CVE-2026-16442

Account takeover in Red Hat Build of Keycloak allows an unauthenticated attacker to abuse the reset-credentials flow in

Authentication bypass in Red Hat Build of Keycloak (and Red Hat Single Sign-On 7) lets an unauthenticated attacker forge

Privilege escalation in Red Hat Build of Keycloak's Dynamic Client Registration (DCR) grants an attacker with low-privil

Mismatched handling of the HTTP/1 absolute-form request authority in Red Hat build of Quarkus and other affected Red Hat

Authorization bypass in the Keycloak Policy Enforcer allows any authenticated user to circumvent all enforced access con

URI normalization bypass in Keycloak's Authorization Services PathMatcher allows authenticated low-privilege users to re

Privilege escalation in Keycloak's Dynamic Client Registration (DCR) component allows attackers with standard user accou

Token exchange in Keycloak bypasses Google Workspace domain allowlist restrictions, enabling any valid Google account ho

Signature-verification bypass in Keycloak (and Red Hat's Keycloak-based products such as Red Hat Single Sign-On 7 and Re

Tenant-restriction bypass in Keycloak's Microsoft identity provider integration allows attackers holding any valid Micro

Session hijacking via SAML assertion replay in Keycloak's SAML broker component allows adjacent-network attackers to aut

Open redirect in Red Hat build of Keycloak permits remote attackers to send victims to attacker-controlled hosts by abus