Red Hat Single Sign On 7
Monthly
Improper handling of HTTP/2 and HTTP/3 Extended CONNECT requests in Netty-based services can downgrade them to ordinary CONNECT requests, enabling request-smuggling or desynchronization in deployments where a fronting proxy and backend interpret the downgraded request differently. The issue carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N), meaning unauthenticated remote attackers can affect integrity, though the independent assessment raises attack complexity to High and scope to Changed and limits practical impact to proxy/gateway mismatches on endpoints that accept HTTP/2 or HTTP/3 Extended CONNECT. No CISA KEV entry or public exploit code was identified at time of analysis, so priority is moderate and conditional rather than urgent.
SMTP command injection in Netty's netty-codec-smtp allows unauthenticated remote attackers to inject arbitrary SMTP commands via CRLF sequences in the command-name field, affecting applications built on Netty such as Red Hat Build of Apache Camel for Spring Boot 4, Red Hat Fuse 7, JBoss EAP 7, and Red Hat Single Sign-On 7. This is an incomplete fix of CVE-2025-59419, requiring attacker-controlled input to reach the SMTP command name and a downstream SMTP server that acts on smuggled commands; no public exploit identified at time of analysis. Integrity impact is high, while confidentiality and availability are unaffected.
Mismatched handling of the HTTP/1 absolute-form request authority in Red Hat build of Quarkus and other affected Red Hat middleware lets a remote, unauthenticated attacker smuggle requests across the HTTP/1-to-HTTP/2 protocol boundary, overriding the :authority pseudo-header that downstream services use for routing and authorization. The vendor CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N = 8.2 High) rates integrity as the dominant impact (I:H) with limited confidentiality exposure (C:L) and no availability effect, consistent with a CWE-444 request-smuggling class defect. Exploitation is not confirmed actively exploited (no CISA KEV listing) and no public exploit identified at time of analysis, although real-world exploitation requires a deployment that actually translates HTTP/1 requests into HTTP/2 and a downstream component that trusts :authority for routing or authorization decisions.
Malformed HTTP/2 CONNECT stream injection in Red Hat JBoss EAP and the wider Red Hat middleware stack (Quarkus, Keycloak, Camel for Spring Boot 4 and Quarkus 3, Data Grid 8, AMQ Broker 7, Fuse 7, Apicurio Registry 3, Debezium 3) lets unauthenticated remote attackers control the :authority of an upstream HTTP/2 CONNECT when the product is deployed as an HTTP/1-to-HTTP/2 translating proxy or gateway. The client-supplied Host header from an HTTP/1 authority-form CONNECT is copied verbatim into the HTTP/2 :authority pseudo-header, so the fronting component and the HTTP/2 backend can disagree about the routing target, yielding an integrity impact (vendor CVSS 3.1 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N; our assessment raises the attack complexity to High and the scope to Changed because a H1→H2 CONNECT translation path and a fronting-proxy topology are required). No public exploit identified at time of analysis, and no EPSS or CISA KEV data was provided.
Netty's codec-rtsp component silently normalizes away trailing control bytes in RTSP method tokens, so a wire request whose method token ends in a byte with code point <= 0x20 immediately before the separating space (for example PLAY\x00 or PLAY\r) is decoded as a fully successful PLAY request with decoderResult().isSuccess() == true and request.method() referencing the same cached singleton object, leaving the application layer unable to distinguish it from a clean PLAY. This is a remote, unauthenticated, low-complexity integrity flaw (CVSS 3.1 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) affecting any product that embeds Netty and exposes an RTSP listener, including the Red Hat components named in the advisory such as AMQ Broker 7, AMQ Clients, Quarkus, Camel for Quarkus 3/Spring Boot 4, Keycloak, JBoss EAP 7/8, Single Sign-On 7, Data Grid 8, Fuse 7, Debezium 3, and Apicurio Registry 3. Real security impact is gated on a downstream disagreement: a front-end proxy, WAF, gateway, or access-control layer must parse the RTSP method differently from Netty for method/request smuggling to produce genuine integrity effects, and exposure is narrow because RTSP listeners are far less commonly internet-facing than HTTP. Exploitation status: no public exploit identified at time of analysis and no CISA KEV confirmation, though the upstream advisory itself documents a minimal wire-level reproduction at a high level.
Remote unauthenticated attackers can exhaust memory in Netty-based services that parse PROXY protocol v2, due to a reference-count leak in the handling of nested TLVs within HAProxyMessageDecoder, leading to denial of service. The flaw is an incomplete fix of upstream PR #16881, so partially patched deployments may remain vulnerable through the grandchild-TLV code path. It affects numerous Red Hat products bundling Netty, such as JBoss EAP 7, Keycloak, and Quarkus, and no public exploit code has been identified at time of analysis.
Unbounded per-connection queue growth in Netty's WebSocketServerExtensionHandler lets unauthenticated remote attackers exhaust server memory (OutOfMemory) and cause denial of service in Red Hat products that bundle the affected Netty code, including AMQ Broker 7, AMQ Clients, Build of Keycloak, Build of Quarkus, Camel for Spring Boot 4, Camel 4 for Quarkus 3, Data Grid 8, Fuse 7, JBoss EAP 7/8, Single Sign-On 7, Apicurio Registry 3 and Debezium 3. The flaw carries CVSS 3.1 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - unauthenticated, no user interaction, availability-only) and is reachable only where a Netty-based server exposes a WebSocket endpoint that negotiates protocol extensions such as permessage-deflate to untrusted clients. No public exploit identified at time of analysis, and no CISA KEV listing; impact is confined to availability, with no confidentiality or integrity loss.
Denial of service in Red Hat's Camel-based and Java middleware products (Red Hat Build of Apache Camel for Spring Boot 4, Red Hat Fuse 7, JBoss EAP 7, and Red Hat Single Sign-On 7): a STOMP frame that declares an oversized content-length is truncated from a 64-bit long to a 32-bit integer, yielding a wrapped/negative length that leaves the STOMP decoder unable to advance, so it loops indefinitely and burns CPU on the affected message-processing thread. The flaw is remotely reachable and unauthenticated per the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5), but exposure is strictly limited to deployments that actually enable a network-reachable STOMP listener - products without a configured STOMP endpoint are not attackable. No confirmed active exploitation (CISA KEV) and no public exploit code identified at time of analysis.
Unbounded heap memory consumption in Netty's HttpServerCodec (io.netty:netty-codec-http) lets a remote, unauthenticated attacker drive a denial of service by exhausting server memory. An attacker who pipelines multiple HTTP/1.1 requests on a single connection and withholds reads prevents the internal methodOverflowQueue from being drained, so memory grows without limit; the assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) is availability-only with no confidentiality or integrity impact, and no public exploit code was identified at time of analysis. Any HTTP/1.1 server built on the default Netty codec behavior is affected, and fixes ship in Netty 4.1.138.Final and 4.2.18.Final, with corresponding patched Red Hat product builds referenced through the Red Hat advisory.
Unbounded remote-initiated stream creation in Netty's SpdySessionHandler allows an unauthenticated, network-positioned attacker to exhaust JVM heap and direct memory on any application that exposes a SPDY endpoint, producing OutOfMemoryError and a denial of service. The handler initializes localConcurrentStreams to Integer.MAX_VALUE and provides no API to change it, so no supported configuration knob reduces the exposure once SPDY is reachable; Netty 4.1.x before 4.1.138.Final and 4.2.x before 4.2.18.Final are affected, along with the Red Hat products that bundle those versions (AMQ Broker and AMQ Clients, Camel for Quarkus 3 and for Spring Boot 4, Keycloak, Quarkus, Debezium, Apicurio Registry, Data Grid, Fuse, JBoss EAP 7/8, and RH-SSO 7). Exploitation requires the target application to have explicitly wired the SPDY handler into its Netty pipeline, since SPDY is a deprecated protocol that is not enabled by default; there is no public exploit identified at time of analysis, and the CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5) reflects a low-complexity, availability-only denial of service with no confidentiality or integrity impact.
Memory exhaustion in Netty's SMTP client response decoder (SmtpResponseDecoder) allows an attacker who controls or can intercept the SMTP server that an application talks to, to force that application to accumulate unlimited multi-line responses until heap is exhausted. The defect is a pure availability issue (C:N/I:N/A:H, CVSS 7.5, AV:N/AC:L/PR:N/UI:N) and is reachable without authentication or user interaction on the victim side, but exploitation is conditional: the vulnerable JVM must have Netty's SMTP client codec active and must establish an SMTP session with a hostile or man-in-the-middle peer, since only server responses are parsed. Shipping products affected through bundled Netty include Red Hat JBoss Enterprise Application Platform 7, Red Hat Fuse 7, Red Hat Single Sign-On 7 and Red Hat Build of Apache Camel for Spring Boot 4; no public exploit code has been identified at time of analysis and there is no confirmed CISA KEV entry.
Heap exhaustion in Netty's Redis array aggregator, as shipped inside Red Hat products such as JBoss Enterprise Application Platform 7, Red Hat Fuse 7, Red Hat Build of Apache Camel for Spring Boot 4, and Red Hat Single Sign-On 7, lets a remote unauthenticated attacker crash the JVM by sending a tiny stream of nested RESP array headers. Because the decoder eagerly allocates an ArrayList sized to the declared array length before any child element arrives, roughly 12 KB of crafted input can reserve about 1.02 billion child slots when the default 1024-level nesting limit and default element limit are in effect; the impact is availability-only, with no data read or modified. Exploitation is limited to deployments that feed attacker-reachable, untrusted RESP/Redis-protocol traffic into the Netty codec with the default constructor; no public exploit code and no confirmed active exploitation were identified at time of analysis.
Denial of service in Netty's MQTT decoder lets unauthenticated remote attackers exhaust server memory and CPU by sending a crafted CONNECT packet whose Properties Length is enormous while its Remaining Length stays small, bypassing the maxBytesInMessage guard that was added to fix CVE-2026-44248. The issue affects any Netty pipeline that runs io.netty.handler.codec.mqtt.MqttDecoder and exposes an MQTT listener; downstream Red Hat products such as AMQ Broker 7, Fuse 7, JBoss EAP 7, Red Hat Single Sign-On 7, and Red Hat Build of Apache Camel for Spring Boot 4 are listed as affected. No public exploit has been identified at time of analysis, and the practical risk is bounded by the need to expose an MQTT endpoint.
Unauthenticated remote attackers can cause a gradual denial of service in applications that use Netty's STOMP codec by sending a STOMP frame body without the terminating null byte; StompSubframeDecoder leaks a ByteBuf for each such frame, so sustained traffic exhausts JVM heap or direct memory. The issue carries CVSS 3.1 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), meaning network-reachable, no authentication or user interaction, availability-only impact. Red Hat middleware products listed in CPE data are affected when STOMP-over-TCP/WebSocket is enabled; no public exploit code or confirmed active exploitation was identified at time of analysis, and a practical DoS requires repeated frames rather than a single packet.
A remote, unauthenticated attacker can exhaust the JVM heap and cause a denial of service by sending a small crafted image to any RESTEasy (JAX-RS) endpoint that consumes an image request body, because the framework's IIOImageProvider decodes the image through ImageIO without validating declared dimensions or pixel count. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) confirms a clean, low-complexity, availability-only flaw with no confidentiality or integrity impact, consistent with CWE-409 data amplification. Reachability is the key limiting factor: only applications that actually expose a resource method consuming image content types through the image provider are affected, and no public exploit code was identified at time of analysis.
Unauthenticated remote memory exhaustion in Keycloak's theme localization endpoints allows any network-reachable attacker to crash the server by flooding the keycloak-services component with unique locale tags, each of which is retained indefinitely in an unbounded in-memory cache. The flaw affects Red Hat Build of Keycloak and Red Hat Single Sign-On 7 deployments where those endpoints are exposed to untrusted networks, and requires no credentials or user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5, CWE-400). Impact is availability-only with no data disclosure or integrity compromise, and no public exploit code has been identified at time of analysis, nor is there confirmed active exploitation (CISA KEV).
Missing authorization enforcement in the Keycloak policy enforcer lets an authenticated user bypass path-based security policies in Red Hat Build of Keycloak and Red Hat Single Sign-On 7 deployments, gaining access to administrative or private application endpoints that the configured policies intended to protect. The flaw lies in how the enforcer normalizes request URLs containing encoded semicolons or directory-traversal segments, causing it to select a less restrictive policy than the one the backend application ultimately resolves to. Exploitation requires a valid account (even low-privileged), network reachability and an application deployed behind the policy enforcer using path-based authorization; no public exploit code was identified at time of analysis and the issue is not confirmed as actively exploited. Red Hat has published errata addressing the defect.
Native memory exhaustion in Keycloak's SAML Redirect Binding allows an unauthenticated remote attacker to degrade or halt the service by repeatedly sending malformed SAML requests that leak zlib-allocated native memory. Red Hat Build of Keycloak, Red Hat Single Sign-On 7, Red Hat Data Grid 8, and the Red Hat JBoss EAP Expansion Pack are all affected because they embed the same SAML handling code. There is no public exploit identified at time of analysis, and the assessed impact is availability-only (CVSS 7.5, C:N/I:N/A:H), consistent with a genuine but bounded denial-of-service condition; vendor errata (RHSA-2026:68276 through RHSA-2026:68280) address the flaw.
Undertow's WebSocket subsystem fails to enforce configurable upper bounds on message buffer sizes and session timeouts, which default to unlimited, allowing unauthenticated remote attackers to exhaust JVM heap memory or hold connections open indefinitely until the server crashes. Affected deployments span Red Hat JBoss EAP 7, Red Hat Fuse 7, Red Hat Build of Apache Camel for Spring Boot 4, and Undertow packages in RHEL 8, 9, and 10. No public exploit code has been identified at time of analysis, though the attack primitive requires no specialized tooling and has no complexity or authentication barrier.
Denial-of-service in Undertow's WebSocket permessage-deflate implementation allows unauthenticated remote attackers to exhaust server memory by sending specially crafted compressed WebSocket messages. The root cause is exponential buffer doubling in the PerMessageDeflateFunction.largerBuffer() method (CWE-770), which triggers unbounded memory allocation with no confirmation of active exploitation at time of analysis. Affected deployments span a broad Red Hat ecosystem including JBoss EAP 7/8, Red Hat Data Grid 8, Apache Camel for Spring Boot 4, and RHEL 8/9/10 packages that bundle Undertow.
WildFly Elytron's password hashing and verification subsystem silently normalizes Unicode input via NFKC before hashing, collapsing fullwidth characters (e.g., U+FF21 'Ａ') to their ASCII equivalents (e.g., 'A'). This allows an unauthenticated remote attacker to authenticate against accounts whose owners believed their passwords contained unique non-ASCII characters by submitting a standard ASCII-only dictionary - the normalization makes the stored hash indistinguishable from its ASCII equivalent. Affected deployments span Red Hat JBoss EAP 7 and 8, Red Hat Build of Keycloak, Red Hat Data Grid 8, and several other Red Hat middleware products that share the Elytron security layer. No public exploit code or CISA KEV listing has been identified at time of analysis.
Account takeover in Red Hat Build of Keycloak allows an unauthenticated attacker to abuse the reset-credentials flow in the keycloak-services component to complete a password reset for any user without ever clicking the emailed verification link, letting them directly set new credentials. Because the mandatory email-ownership check can be bypassed, the flaw yields full control of arbitrary accounts (CVSS 9.1). No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Session hijacking via SAML assertion replay in Keycloak's SAML broker component allows adjacent-network attackers to authenticate as arbitrary users without credentials. When Keycloak is deployed as a SAML broker in IdP-Initiated flow mode, it fails to enforce the SAML OneTimeUse condition, permitting a captured assertion to be submitted multiple times. No public exploit has been identified at time of analysis, and EPSS sits at 0.14% (4th percentile), though SSVC rates technical impact as total - reflecting the full account takeover consequence if the preconditions are met.
Account takeover in Keycloak (Red Hat build of Keycloak, Red Hat Single Sign-On 7) arises because the IdP-initiated SAML SSO endpoint does not verify whether an upstream identity provider is restricted to account-linking-only mode. An attacker who controls a linked upstream identity can drive that endpoint to complete a full login rather than a mere link operation, seizing complete access to the corresponding local user account. Red Hat has shipped fixes; there is no public exploit identified at time of analysis and EPSS exploitation probability is low (0.19%).
Privilege escalation in Keycloak's Dynamic Client Registration (DCR) component allows attackers with standard user accounts and limited Initial Access Tokens to forge administrative roles directly into their own access tokens. The underlying flaw is a missing claim-path validation in the default DCR policy for User Property mappers, which permits writing attacker-controlled values into sensitive internal claim locations that normally carry role and privilege assertions. Successful exploitation enables takeover of other registered OAuth clients, exfiltration of confidential client secrets, and full administrative control over the affected Keycloak realm. No confirmed active exploitation or public exploit code is identified at time of analysis.
URI normalization bypass in Keycloak's Authorization Services PathMatcher allows authenticated low-privilege users to reach administrative or restricted endpoints by appending trailing slashes or matrix parameters to request URIs. Affected deployments include Red Hat Build of Keycloak, Red Hat Single Sign-On 7, Red Hat Data Grid 8, and Red Hat JBoss EAP Expansion Pack. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog, though the high CVSS confidentiality and integrity impact scores reflect meaningful privilege escalation risk in production environments.
Authentication bypass in Red Hat Build of Keycloak (and Red Hat Single Sign-On 7) lets an unauthenticated attacker forge SAML responses to hijack accounts when a SAML identity-provider's metadata was imported without explicit key-usage attributes, causing the keycloak-services identity-brokering engine to silently disable signature validation despite a signing certificate being present. Rated CVSS 9.1 with total technical impact per CISA SSVC, an attacker who knows a victim's external identifier can log in as that user. No public exploit identified at time of analysis, and EPSS is low (0.14%, 4th percentile), indicating the risk is currently theoretical/targeted rather than mass-exploited.
Privilege escalation in Red Hat Build of Keycloak's user creation component exposes environments running Fine-Grained Admin Permissions V2 (FGAP V2) to unauthorized group assignment by scoped sub-administrators. A sub-admin holding only user-create permissions can bypass group-level authorization checks and enroll newly created users into any group - including privileged or sensitive ones - well beyond the sub-admin's delegated scope. SSVC rates technical impact as total and no public exploit has been identified, though the EPSS score of 0.24% (15th percentile) and SSVC exploitation status of 'none' indicate low immediate exploitation likelihood.
Token exchange in Keycloak bypasses Google Workspace domain allowlist restrictions, enabling any valid Google account holder - regardless of their domain - to swap a Google OAuth token for a Keycloak realm token and gain unauthorized access. Affected deployments are those specifically configured to restrict Google-based logins to approved Workspace domains while also having token exchange enabled; both conditions must be present. No public exploit code has been identified at time of analysis, and EPSS sits at 0.20% (10th percentile), consistent with SSVC's exploitation status of 'none', though SSVC rates technical impact as 'total' given that successful exploitation delivers full realm access.
Tenant-restriction bypass in Keycloak's Microsoft identity provider integration allows attackers holding any valid Microsoft OAuth token - even from a completely unrelated Azure AD organization - to authenticate into a Keycloak realm via the token exchange feature. Affected deployments include Red Hat Build of Keycloak, Red Hat Single Sign-On 7, and Red Hat JBoss EAP Expansion Pack. With CVSS PR:L reflecting the need for a valid Microsoft credential (trivially obtained by registering a free Azure tenant), successful exploitation grants high confidentiality and integrity impact within the realm. No public exploit or active exploitation has been identified at time of analysis; EPSS sits at 0.19% (9th percentile), consistent with SSVC exploitation=none.
Signature-verification bypass in Keycloak (and Red Hat's Keycloak-based products such as Red Hat Single Sign-On 7 and Red Hat Build of Keycloak 26.6/26.6.4) lets an attacker holding valid client credentials abuse a JWT algorithm-confusion weakness in the JWT Authorization Grant flow to forge client assertions and mint unauthorized access tokens. The forged tokens allow impersonation of any federated user tied to the affected Identity Provider, yielding unauthorized access and potential privilege escalation. There is no public exploit identified at time of analysis and the issue is not on CISA KEV; Red Hat rates it 8.1 (High).
Privilege escalation in Keycloak allows a limited administrator to become a full realm administrator by importing users with realm-admin role mappings via the POST /admin/realms/{realm}/partialImport endpoint, bypassing Fine-Grained Admin Permissions (FGAP). Exploitation requires a high-privilege authenticated user, and while a proof-of-concept exploit exists, the EPSS score is very low (0.03%) and there is no evidence of active exploitation.
HTTP request smuggling in Undertow (the embedded web server underpinning JBoss EAP, Red Hat Data Grid, and Apache Camel for Spring Boot) allows remote unauthenticated attackers to bypass front-end security controls by prepending whitespace to header lines. Undertow strips leading spaces from the first header line in violation of RFC 7230, creating a parser discrepancy between upstream proxies and the application server. No public exploit identified at time of analysis, and EPSS sits at 0.13% (32nd percentile), but the CVSS 9.1 and broad Red Hat middleware exposure make this a high-value target for chained attacks.
HTTP request smuggling in Undertow allows remote unauthenticated attackers to send `\r\r\r` as a header block terminator, which can desynchronize parsing when Undertow sits behind specific intermediaries such as older Apache Traffic Server or Google Cloud Classic Application Load Balancer. The flaw affects numerous Red Hat distributions of Undertow (JBoss EAP 7/8, Data Grid 8, Fuse 7, Camel for Spring Boot 4, RHEL 8/9/10) and carries a CVSS 9.1, though EPSS is only 0.04% and there is no public exploit identified at time of analysis.
HTTP request smuggling in Red Hat Undertow allows remote unauthenticated attackers to bypass front-end security controls by exploiting parsing discrepancies between Undertow and upstream proxies when handling crafted header names. The flaw (CWE-444) affects Undertow embedded in multiple Red Hat products including JBoss EAP 7/8, Data Grid 8, Fuse 7, and Apache Camel for Spring Boot 4, with Red Hat issuing patches via RHSA-2026:25125 and RHSA-2026:25126. There is no public exploit identified at time of analysis and EPSS is low (0.10%), but CVSS 9.1 and SSVC 'total' technical impact warrant prompt patching of internet-facing deployments.
Stored cross-site scripting in the login theme rendering component of Keycloak (and its downstream Red Hat Build of Keycloak and Red Hat Single Sign-On 7 products) lets a realm administrator inject malicious JavaScript into display fields that is later executed in the browsers of users loading the affected realm's login page. Exploitation requires an authenticated realm administrator (CVSS PR:H) who can both reach the theme display fields and bypass the input-sanitizing security filter, so this is a privilege-abuse or post-compromise vector rather than an anonymous remote attack; impact is limited to the confidentiality and integrity of affected users' sessions (C:L/I:L) with no availability impact. There is no public exploit identified at time of analysis and no CISA KEV listing; overall this is a genuine but modest-priority issue rather than a high-urgency crisis.
Offline tokens issued by Keycloak, Red Hat Build of Keycloak, and Red Hat Single Sign-On 7 can stay valid after a backchannel logout because a serialization bug in the OIDC Dynamic Client Registration (DCR) response omits the backchannel-logout offline-token-revocation setting, silently disabling it whenever a client is updated through the standard update flow (CVE-2026-107623, CVSS 3.1 4.3, CWE-862). The actor must hold client-management/registration privileges (AV:N/PR:L), and the deployment must use DCR and rely on backchannel logout to revoke offline tokens, so this is a loss of a revocation guarantee rather than an account takeover. No public exploit code was identified at time of analysis and the issue is not in CISA KEV; EPSS signal is not available in the supplied data, and the assessed real-world risk remains low.
Keycloak, including the Red Hat Build of Keycloak and Red Hat Single Sign-On 7, exposes the active primary secret of confidential clients to any authenticated realm administrator who holds only the read-only view-clients role. The flaw sits in the installation provider and client registration endpoints, which return client credentials that a read-only administrator should never be able to read; with the leaked secret an attacker can authenticate as the confidential client and inherit its service account permissions across integrated services. Exploitation requires an existing realm administrator account with the view-clients role, so risk scales with how broadly that low-trust role is delegated, and no public exploit has been identified at time of analysis.
Keycloak's SMTP email configuration can silently fall back to unencrypted communication when STARTTLS is enabled, allowing an attacker who can intercept and tamper with traffic between the Keycloak server and its mail relay to capture SMTP credentials and email message content in cleartext. Affected deployments include Red Hat Build of Keycloak and Red Hat Single Sign-On 7 (CVSS 6.5, AV:N/AC:H/PR:N/UI:N), but exploitation is conditional: it requires a man-in-the-middle position on the SMTP path and an instance configured for opportunistic STARTTLS rather than implicit TLS. No public exploit code or confirmed active exploitation has been identified at time of analysis.
Authentication bypass in Keycloak's OIDC Device Authorization Grant flow allows an attacker who already possesses a valid user password to evade a client's configured minimum authentication level, including mandatory multi-factor authentication, and gain unauthorized access to the Keycloak Admin REST API, according to Red Hat. The flaw is a missing enforcement check (CWE-287) affecting Red Hat Build of Keycloak and Red Hat Single Sign-On 7 deployments where the device authorization flow is enabled for a client that requires elevated authentication. Exploitation requires prior credential compromise (CVSS PR:L) and the targeted client must actually mandate MFA or another authentication level; no public exploit code or CISA KEV active exploitation is identified in the available data, and EPSS is not provided. The CVSS score is 5.4 (moderate), with limited confidentiality and integrity impact.
Blind server-side request forgery in the X.509 client-certificate authenticator of Keycloak (and the downstream Red Hat Build of Keycloak and Red Hat Single Sign-On 7) lets an unauthenticated remote attacker induce the server to make outbound requests to URLs specified in a crafted client certificate, before that certificate has been fully validated. The flaw is reachable only when X.509 client-certificate authentication is enabled and certificate revocation checking via CRL Distribution Points or OCSP is configured - a non-default setup, which is why the assessed vector carries AC:H despite PR:N/UI:N. Impact is limited to low confidentiality (the SSRF is blind and no response content is returned to the attacker), and no public exploit has been identified at time of analysis.
Information disclosure and denial of service in Keycloak's X.509 client certificate authenticator occur when CRL Distribution Point checking is enabled and an unauthenticated remote attacker submits a crafted client certificate. The server fails to properly validate file paths from the certificate, allowing limited local file reads and extreme memory consumption that can crash the system; exploitation requires the non-default combination of certificate-based client authentication and CRL checking, and no public exploit was identified at time of analysis.
Keycloak's Micrometer user-event metrics listener can be forced to create unbounded metric time series by unauthenticated remote requests to the identity broker login endpoint with arbitrary provider aliases, leading to memory exhaustion and performance degradation. This is a low-priority issue because exploitation requires the non-default configuration of including the 'idp' tag in the listener, and the impact is limited to a gradual availability degradation (A:L). No public exploit code has been identified at the time of analysis.
Privilege escalation in the Fine-Grained Admin Permissions v2 (FGAP v2) feature of Keycloak lets an authenticated delegated administrator with role-assignment rights grant a composite role whose transitive contents are never inspected, silently conferring full realm administrative control. Exploitation requires that FGAP v2 be enabled for delegated administration, a limited-admin credential holding role-mapping permissions (CVSS vector PR:H), and the presence of a composite role that transitively contains realm-admin privileges within that administrator's assignable scope; the high attack complexity (AC:H) reflects these preconditions rather than any exploitation difficulty, and the resulting impact is a complete confidentiality, integrity, and availability compromise of the realm (CVSS 6.6). No public exploit code and no confirmed active exploitation have been identified at time of analysis, so this should be treated as a genuine but conditional authorization-logic flaw rather than a remotely exploitable takeover.
mTLS holder-of-key certificate binding is not enforced in Keycloak's Standard Token Exchange V2 flow, so an attacker who already holds valid confidential client credentials can obtain a standard, unrestricted token that escapes the certificate-binding protection the deployment believed was in place. Affected distributions include Red Hat Build of Keycloak and Red Hat Single Sign-On 7, and exploitation is conditional on three things being true at once: the attacker must already possess a stolen client secret or key (the CVSS vector rates this PR:L - a precondition the flaw itself does not grant), the deployment must have Standard Token Exchange V2 enabled and in active use, and the deployment must be relying on mTLS holder-of-key binding as a hardening control. No public exploit code has been identified at time of analysis and there is no CISA KEV listing; the assessed vector (AV:N/AC:H/PR:L/UI:N, C:H/I:H/A:N) reflects a genuine but conditional security-control bypass rather than a mass-exploitable flaw, since certificate-bound tokens are a non-default opt-in configuration.
Information disclosure in the Keycloak Admin REST API lets an authenticated delegated administrator holding only basic group/role search privileges enumerate every group assigned to a given role, including groups they are supposed to be unable to see. The flaw (CWE-862, missing authorization) affects the Admin REST API endpoints that return role-to-group mappings in Keycloak, Red Hat Build of Keycloak, and Red Hat Single Sign-On 7, and is rated CVSS 3.1 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) - a read-only confidentiality impact with no integrity or availability effect. It requires valid, privileged-but-scoped credentials and is only meaningful where an organization actually partitions group visibility across delegated admins; there is no public exploit identified at time of analysis and the issue is not confirmed actively exploited (no CISA KEV listing).
Authenticated delegated administrators in Keycloak can reset other users' passwords and take over their accounts when Fine-Grained Admin Permissions (FGAP) are enabled, because the Admin REST API's general user-update path skips the password-reset authorization check that the dedicated credential-reset flow enforces. Red Hat Build of Keycloak and Red Hat Single Sign-On 7 are the affected downstream products, and the flaw is rated 6.6 (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H, CWE-862). Exploitation is conditionally gated rather than internet-facing: it requires a non-default FGAP configuration and an already-provisioned semi-trusted admin holding user-profile edit rights but deliberately denied password-reset rights, making this an insider or lateral privilege-escalation issue; no public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis.
Keycloak's Level of Authentication (LoA) step-up enforcement can fail open: when a relying client requires a higher authentication level for a user who already holds an active session at a lower level, a logic error in session re-evaluation causes Keycloak to issue a token carrying the lower acr/LoA claim instead of forcing the required step-up authentication. The impact is a bounded assurance downgrade rather than unauthenticated access - the attacker must already be authenticated (CVSS PR:L) - but it may grant access to sensitive resources whose authorization decisions trust those claims, with low confidentiality and integrity impact and no availability impact (CVSS:3.1 4.2, AV:N/AC:H/UI:N/S:U/C:L/I:L/A:N). Exploitation depends on a deployment that actually configures per-client step-up/LoA and on a specific session-state and re-evaluation timing; no public exploit code has been identified at time of analysis and this CVE is not listed in CISA KEV.
Second-factor authentication bypass in Keycloak's Conditional OTP authenticator allows an attacker who already possesses a user's password to skip OTP verification by sending a crafted HTTP header, provided the realm is configured to evaluate headers for OTP-skipping without validating their source. This flaw affects Red Hat Build of Keycloak and Red Hat Single Sign-On 7, has a CVSS score of 6.8 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N), and requires a non-default configuration plus a compromised first factor, meaning it is an account-targeted MFA bypass rather than unauthenticated remote compromise. No public exploit has been identified at the time of analysis.
Keycloak's Pushed Authorization Request implementation can allow an authenticated OAuth client to reuse a previously pushed request_uri when the prompt=none silent-authentication path is used, resulting in multiple authorization codes for an already signed-in user. Exploitation requires a live victim session, PAR enabled, and an authenticated low-privilege client (PR:L), with high attack complexity and limited impact; CVSS is 4.2. No public exploit identified at time of analysis, and no CISA KEV confirmation was provided.
Authentication bypass in the Keycloak (Red Hat Build of Keycloak) Kerberos federation provider lets an attacker on the same or adjacent network impersonate the Key Distribution Center and bypass Kerberos password authentication, potentially gaining unauthorized access to user accounts. The flaw only manifests in the specific, non-default configuration where Kerberos PASSWORD authentication is used while SPNEGO is disabled, because that mode never requests a server ticket to verify the KDC's identity. Rated CVSS 3.1 6.8 (AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N), exploitation requires network adjacency and an active on-path spoofing operation; no public exploit code has been identified and the CVE has not been listed as confirmed actively exploited (CISA KEV).
Keycloak's Admin REST API allows authenticated administrators with delegated privileges over a realm to read or modify sensitive client configurations in the master realm by abusing a per-request in-memory cache that resolves clients by unique identifier without verifying realm ownership. The flaw affects Red Hat Build of Keycloak and Red Hat Single Sign-On 7, requires the attacker to hold privileged delegated administration rights and to know or reference a target client's unique ID, and is assessed as a moderate-priority authorization issue rather than a high-CVSS critical defect. No public exploit code was identified at time of analysis, and successful exploitation could expose client credentials or redirect administrative login attempts to malicious sites.
Missing authorization checks in the Keycloak Authorization Services policy evaluation endpoint allow an authenticated delegated administrator with limited viewing privileges to read the full profile and role information of any user in the realm, including email addresses and assigned security roles. This moderate-severity information-disclosure issue affects Red Hat Build of Keycloak and Red Hat Single Sign-On 7. No public exploit code has been identified at time of analysis.
Delegated administrators in Keycloak can bypass fine-grained reset-password restrictions through the Admin REST API's credential-deletion endpoint, deleting a targeted user's password credentials and locking that user out. The flaw (CWE-862) requires an authenticated, provisioned delegated admin who has user-management access but is specifically not granted the manage-credentials/reset-password permission; it is an insider/delegated-tenant privilege-boundary escalation within the admin's reachable user scope, not unauthenticated exploitation, account takeover, or data disclosure. No public exploit code has been identified at time of analysis, and exploitation depends on Keycloak's fine-grained admin permissions model being deployed.
Privilege escalation in the Keycloak Admin REST API allows an already-authenticated delegated administrator to add their own account to a group that carries administrative role mappings, turning scoped, fine-grained management rights into effective control of the entire realm. The group-membership endpoints do not verify whether the target group grants privileged roles (CWE-862, Missing Authorization), so the escalation is a single API call away for anyone holding manage-users or equivalent group-scoped permissions. Reachability is limited: anonymous users and ordinary end-users cannot trigger it, a high-privilege group must already exist in the same realm, and deployments that only use a single super-admin gain nothing new because those actors are already fully privileged. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV. Affected builds include Red Hat Build of Keycloak and Red Hat Single Sign-On 7.
Keycloak's OpenID Connect token refresh path can issue fresh access tokens on behalf of an OIDC client that an administrator has already disabled, because the server restores requested audiences from stored client IDs without re-checking whether that audience client is still enabled. An attacker who already possesses a valid, unexpired refresh token for the affected client can therefore keep obtaining usable access tokens after the client is turned off, but only against resource servers that validate the JWT locally (offline signature/claim checks) rather than calling Keycloak for introspection or userinfo. Scoring is low at CVSS 4.2 (AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N), no public exploit code was identified at time of analysis, and exploitation requires both a live refresh token and a client that was disabled after that token was issued.
HTTP request smuggling in Netty's HTTP/1 decoder lets remote, unauthenticated attackers bypass front-end security controls and reach resources they should not access by sending requests with malformed Transfer-Encoding headers. Netty is a widely embedded Java networking library, so the practical reach spans Red Hat products built on it - AMQ Broker 7, AMQ Clients, Red Hat Build of Keycloak, Red Hat Build of Quarkus, Red Hat Build of Apache Camel (Spring Boot 4 and Quarkus 3), Red Hat Build of Debezium 3, Red Hat Build of Apicurio Registry 3, Red Hat Data Grid 8 and Red Hat Fuse 7 - as well as JBoss EAP 7/8 and Red Hat Single Sign-On 7 per the associated advisory tags. CVSS 3.1 rates it 6.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N), consistent with smuggling-style control bypass rather than full compromise; no public exploit code or confirmed active exploitation was identified at time of analysis, though the flaw is trivially reachable on any exposed HTTP endpoint.
HTTP request smuggling in Netty's netty-codec-http component lets unauthenticated remote attackers bypass front-end security controls by sending a crafted HTTP/1.1 chunk-size token containing whitespace after the hexadecimal digits, which Netty parses differently from other HTTP intermediaries. The flaw carries a CVSS 3.1 base score of 6.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L), meaning no authentication or user interaction is required, but integrity and availability impact is limited; meaningful exploitation generally depends on a multi-tier topology where a proxy, load balancer, or backend parses the chunk-size token inconsistently with Netty. Red Hat ships the affected library across a broad portfolio - including AMQ Broker 7, AMQ Clients, Quarkus, Keycloak and Red Hat Single Sign-On 7, JBoss EAP 7/8, Fuse 7, Data Grid 8, Camel for Spring Boot 4, Camel 4 for Quarkus 3, Apicurio Registry 3 and Debezium 3 - and no public exploit code has been identified at time of analysis, with no confirmed active exploitation (CISA KEV).
HTTP request smuggling and header injection in Netty's HTTP/2 stack (as bundled in multiple Red Hat products) allow remote unauthenticated attackers to bypass security controls and manipulate requests when HTTP/2 traffic is translated to HTTP/1.1. Affected deployments include Red Hat AMQ Broker 7, Camel, Keycloak, Quarkus, Data Grid, Fuse, EAP, Apicurio Registry, and Debezium. Assessed as high severity (CVSS 3.1 base 7.5, AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:N); exploitation requires the specific topology of an HTTP/2-to-HTTP/1.1 translation boundary, and no public exploit was identified at time of analysis.
This is a real but moderate-priority vulnerability whose severity depends almost entirely on deployment topology rather than the raw 6.5 CVSS score. Netty's HTTP decoder lets split or duplicated Transfer-Encoding header fields slip past its final-chunked validation, so an unauthenticated, remote attacker who can send a raw crafted request to a Netty listener that sits in an HTTP chain with a second HTTP parser (reverse proxy, load balancer, CDN, WAF, or upstream/downstream server) can desynchronize the two parsers and smuggle a request (CWE-444). Impact is confined to low confidentiality and integrity loss (C:L/I:L) with no availability impact, no authentication (PR:N) or user interaction (UI:N) is required, and no public exploit identified at time of analysis.
JVM memory exhaustion in the wildfly-elytron-asn1 DERDecoder allows unauthenticated remote attackers to exhaust heap on any service that feeds untrusted DER/ASN.1 bytes into the library, notably SASL authentication flows and X.500 certificate principal parsing. The decoder reads an attacker-supplied length value and attempts a corresponding allocation without validating it against the actual remaining input, so a crafted payload can force an oversized allocation and destabilize or crash the JVM (availability impact only, CVSS 5.9, AV:N/AC:H/PR:N/UI:N/C:N/I:N/A:H, CWE-770). Exploitation is opportunistic rather than deterministic because the AC:H rating means success depends on payload size/repetition relative to the victim's configured heap, and no public exploit code has been identified at time of analysis; the issue is not listed in CISA KEV and no EPSS score was provided. Scope is limited to Red Hat products that bundle the affected elytron-asn1 library, including Red Hat Build of Keycloak, JBoss EAP 7/8 (and EAP XP), Red Hat Single Sign-On 7, Fuse 7, Quarkus, Data Grid 8, Camel, Debezium, and Cryostat.
HTTP request smuggling in Netty's HTTP/1.1 decoder (HttpObjectDecoder and the HttpRequestDecoder built on it) lets remote, unauthenticated attackers send a chunk-size line containing an embedded bare carriage return - for example `0\rX` - because strict chunk-line validation is skipped whenever the size line carries no `;` chunk extension, causing a request-boundary desync when Netty shares a connection with a second HTTP intermediary that frames the message differently. The flaw reaches every application and Red Hat product that embeds Netty, including AMQ Broker 7, AMQ Clients, Quarkus, Camel 4 for Quarkus 3, Camel for Spring Boot 4, Keycloak / Red Hat Single Sign-On, JBoss EAP 7 and 8, Fuse 7, Data Grid 8, Apicurio Registry 3 and Debezium 3, while independent assessment keeps it at CVSS 6.5 with AC:H because a standalone Netty service with no disagreeing proxy in the chain yields little practical smuggling impact. The public report includes a reproducible PoC test harness, but there is no CISA KEV listing and no evidence of active exploitation.
Denial of service in Netty's HTTP/2 HPACK encoder (HpackEncoder) allows an unauthenticated remote attacker to force excessive CPU and memory consumption by sending SETTINGS frames that advertise an oversized MAX_HEADER_TABLE_SIZE, causing the encoder to retain an excessive number of unique header entries. The issue affects applications and Red Hat products that embed Netty and expose an HTTP/2 listener - including JBoss EAP 7 and 8, Keycloak, Red Hat Single Sign-On 7, AMQ Broker 7, Data Grid 8, Fuse 7, Quarkus, Camel 4 for Quarkus 3, Camel for Spring Boot 4, Apicurio Registry 3, and Debezium 3 - while HTTP/1.1-only endpoints are not exposed. Impact is bounded to availability (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L, CVSS 5.3) with no data disclosure or modification; no public exploit code has been identified at time of analysis and there is no confirmed active exploitation.
A signed/unsigned type mismatch in Netty's Memcache binary protocol codec desynchronizes frame boundaries, allowing an unauthenticated, network-positioned attacker to smuggle responses across a shared or proxied memcache connection (CVSS 3.1 base 6.5, Medium). The flaw is reachable only when the Memcache binary codec is explicitly wired into a network-exposed Netty pipeline - a non-default configuration - and the affected code ships inside Red Hat Fuse 7, JBoss Enterprise Application Platform 7, Single Sign-On 7, and the Red Hat Build of Apache Camel for Spring Boot 4. No public exploit code has been identified at time of analysis, and there is no confirmation of active exploitation (not in CISA KEV); impact is limited to confidentiality and integrity (C:L/I:L) with no availability effect.
Keycloak's first broker login flow leaves a temporary account-linking proof behind after a federated identity link is established or manually removed (CWE-613), allowing an attacker who controls the external identity to silently re-establish the link and authenticate as the victim without any further confirmation. The flaw affects Red Hat Build of Keycloak and Red Hat Single Sign-On 7 deployments that use identity brokering, and carries high confidentiality and integrity impact despite a moderate CVSS base of 6.4. No public exploit code was identified at time of analysis and the issue is not listed in CISA KEV.
Keycloak's Dynamic Client Registration endpoint exposes confidential client secrets in cleartext to users holding the view-clients realm management role, violating the principle of least privilege. Affected deployments include Red Hat Build of Keycloak and Red Hat Single Sign-On 7 across all tracked versions. An attacker granted only read-only view-clients access can harvest any confidential OAuth/OIDC client secret via the registration API and subsequently authenticate as that client, escalating their effective permissions within the realm to whatever the compromised client is authorized to do.
Keycloak's Device Authorization Grant flow (RFC 8628) fails to enforce brute-force account lockout during token redemption, allowing an attacker holding an active device authorization session for a locked account to complete the flow and obtain valid access and refresh tokens. Affected deployments include Red Hat Build of Keycloak and Red Hat Single Sign-On 7 across all versions flagged in the CPE data. No public exploit code or CISA KEV listing has been identified at time of analysis, but the flaw silently undermines a core security control intended to stop credential-stuffing and persistent account compromise.
Path traversal in the key provider component of Red Hat Build of Keycloak allows a realm administrator to probe arbitrary filesystem paths by supplying crafted keystore parameters, revealing the existence and readability of server-side files. The vulnerability exists because a prior fix for path probing was incomplete, leaving a residual bypass in the keycloak-services library - the core engine shared by both Red Hat Build of Keycloak and Red Hat Single Sign-On 7. No public exploit code has been identified at time of analysis, and exploitation requires realm administrator credentials, materially limiting opportunistic attack surface.
The AdvertiseListenerImpl component in mod_cluster's core multicast UDP handler can be permanently crashed by a single crafted datagram, affecting Red Hat JBoss Enterprise Application Platform 7 and 8, JBoss Web Server 5 through 7, and Red Hat Single Sign-On 7. An unauthenticated attacker with adjacency to the mod_cluster multicast group can silently terminate the advertise listener thread, causing the affected node to stop receiving cluster topology updates until manually restarted - with no runtime indication of failure since isListening() continues returning true. No public exploit is identified at time of analysis, and this CVE is not listed in the CISA KEV catalog based on available data.
Undertow's HTTP response header writing path silently truncates 16-bit Unicode characters to 8-bit bytes via a narrowing cast in the `writeString()` method, enabling remote unauthenticated attackers to inject ASCII control characters or special symbols into response headers when an application passes unsanitized user-controlled input into those headers. Affected Red Hat distributions include RHEL 8/9/10, JBoss EAP 7, Red Hat Build of Apache Camel for Spring Boot 4, and Red Hat Single Sign-On 7, as reported by Red Hat via Bugzilla #2516038. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
HTTP request smuggling in Undertow's ChunkReader component enables unauthenticated remote attackers to inject out-of-sync requests, bypassing upstream security controls such as authentication layers or reverse-proxy ACLs. Affected deployments include JBoss EAP 7, WildFly, Red Hat Enterprise Linux 8/9/10, Red Hat Data Grid 8, Red Hat Fuse 7, Red Hat Single Sign-On 7, and several Apache Camel-based Red Hat products. No confirmed active exploitation or public proof-of-concept has been identified at time of analysis; the CVSS 5.3 Medium score reflects limited direct impact, though real-world risk in proxy-fronted architectures is meaningfully higher than the score alone suggests.
Unrestricted archive upload in WildFly Core enables authenticated 'deployer' role users to deploy malicious Java archives via HTTP POST requests, potentially achieving arbitrary file reads and further system compromise. Affected products span multiple Red Hat enterprise offerings including JBoss EAP 7 and 8, Red Hat Fuse 7, Process Automation 7, and Single Sign-On 7, all of which embed wildfly-core as a foundational dependency. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Denial of service in WildFly Core (and downstream Red Hat middleware products) allows a remote administrative user to render a server permanently unrecoverable by injecting a malformed payload into the Inet Address field of the Management Model. The injected payload is persisted to standalone.xml, corrupting the configuration file and preventing normal server restart without manual intervention. No public exploit code has been identified at time of analysis, and the vulnerability is limited to users with administrative credentials, reducing its real-world blast radius despite the high availability impact.
Prometheus metric label cardinality exhaustion in Red Hat Build of Keycloak allows any authenticated user to crash the service by flooding its metric store with unique entries. When the Keycloak metrics subsystem is active, failed account operations (such as login attempts referencing nonexistent client IDs) cause raw, unsanitized error strings to be registered as Prometheus label values; because Prometheus stores each unique label combination as a distinct time series, a low-privileged attacker can generate an unbounded number of distinct metric entries, consuming JVM heap until the process crashes or becomes unresponsive. No public exploit code and no CISA KEV listing exist at time of analysis, but the low attack complexity and broad authenticated-user surface make this a realistic denial-of-service risk in any deployment where metrics are enabled.
Keycloak's LDAP storage provider allows delegated administrators to bypass configured search boundaries by supplying a crafted Distinguished Name (DN), exposing account information from unauthorized directory subtrees and triggering unintended user imports into Keycloak local storage. Affected deployments include Red Hat Build of Keycloak, Red Hat Single Sign-On 7, Red Hat Data Grid 8, and the JBoss EAP Expansion Pack. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; exploitation is constrained to authenticated delegated administrators with access to the LDAP federation interface.
Forced logout via unsigned backchannel requests affects Red Hat Build of Keycloak when an OIDC identity provider is configured to skip signature validation. Under this non-default configuration, the backchannel logout endpoint in keycloak-services improperly accepts logout requests lacking any cryptographic signature (CWE-347), violating the OIDC backchannel logout specification. An unauthenticated network attacker who possesses knowledge of a target user's session identifiers can submit a forged unsigned logout request, terminating that session without the user's consent. No public exploit or active exploitation (CISA KEV) has been identified; with CVSS 3.7 and EPSS data absent from the input, this is a low-priority availability-only issue gated by a specific non-default configuration.
Path traversal in WildFly's domain mode LocalFileRepository exposes arbitrary files readable by the Domain Controller process to attackers who have already obtained or compromised a slave host controller. The flaw resides in the wildfly-core/deployment-repository component, where getFile() and getConfigurationFile() fail to canonicalize or bound-check caller-supplied paths before resolving them on disk, enabling directory traversal sequences to escape the configured repository root. No active exploitation is confirmed (not listed in CISA KEV) and no public exploit code has been identified, but successful exploitation yields high-confidence access to sensitive artifacts including keystores, credentials, and configuration files.
Client policy enforcement in Red Hat Build of Keycloak can be bypassed by an authenticated user holding client management permissions, allowing non-compliant OAuth clients to persist in a realm despite administrator-configured security hardening. The bypass exploits improper client state evaluation during update operations: an attacker creates a public client - which passes policy validation - and then updates it to a confidential client type, skipping the re-evaluation that would normally reject a non-compliant confidential client. No public exploit code has been identified and this CVE is not listed in CISA KEV; however, the low attack complexity and broad deployment of Keycloak in enterprise IAM infrastructure elevate its practical significance.
Time-based authorization policy bypass in Red Hat Build of Keycloak permits any low-privileged authenticated user to inject a fabricated timestamp into their authorization request, causing Keycloak's Authorization Services engine to evaluate the forged value instead of the actual server clock. This fully defeats time-based access controls - such as business-hours restrictions - across affected Red Hat products including Keycloak, Single Sign-On 7, Data Grid 8, and JBoss EAP Expansion Pack. No public exploit code has been identified and this CVE is not listed in CISA KEV, but the CVSS High integrity impact accurately reflects that time-gated authorization controls are rendered entirely ineffective against any valid account holder.
The full-scope-disabled client-policy executor in Red Hat Build of Keycloak silently skips enforcement when the fullScopeAllowed attribute is absent from a client registration or update request, allowing a delegated user to create OAuth/OIDC clients with unrestricted scope access. Affected platforms span Red Hat Build of Keycloak, Red Hat Single Sign-On 7, Red Hat Data Grid 8, and JBoss EAP Expansion Pack. An attacker holding delegated registration privileges (CVSS PR:L) can exploit this to issue tokens containing unauthorized role mappings, effectively escalating their effective permissions within any application trusting those tokens. No public exploit code or CISA KEV entry has been identified at time of analysis.
Incomplete HTTP parameter pollution validation in Keycloak's keycloak-services component exposes OIDC authentication flows to session fixation and account confusion attacks. The security check inspects only the query string of redirect URLs while ignoring the URL fragment, enabling an attacker to inject duplicate security parameters when a client is configured with a wildcard redirect URI. No public exploit has been identified at time of analysis; the CVSS score of 3.4 (AC:H, UI:R) correctly reflects that exploitation requires both a permissive wildcard redirect URI configuration and a non-spec-compliant client application that trusts attacker-injected parameters over Keycloak-issued values.
Wildcard domain validation in Keycloak's keycloak-services component can be bypassed by an attacker who controls their connection's reverse DNS, enabling unauthorized client registration or modification against a Keycloak realm. The flaw stems from the system accepting any hostname that merely ends with the configured domain suffix (e.g., 'attackerexample.com' satisfying a '*.example.com' restriction) rather than enforcing true subdomain membership. Exploitation requires high attack complexity due to the reverse DNS control prerequisite, and no public exploit or CISA KEV listing has been identified at the time of analysis.
Incorrect authorization in Keycloak's group policy evaluation allows a low-privileged authenticated user to bypass group membership checks and gain unauthorized access to administrative functions or protected resources. The root cause is a string prefix comparison used to verify child-group membership under an 'extend to child groups' policy: a user in a group whose name shares a leading prefix with a privileged group (e.g., '/admins-external' matching a policy scoped to '/admins') is incorrectly treated as a legitimate child-group member. The CVSS vector (PR:L, I:H) confirms this is an authenticated integrity-bypass with high impact. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Redirect URI policy bypass in Keycloak's secure-client-uris executor enables interception of OAuth authorization codes over unencrypted HTTP connections. The flaw exists because the executor performs only a prefix-string comparison on the redirect URI rather than properly parsing and validating the host component, allowing a specially crafted domain name to satisfy the HTTPS enforcement check while pointing to an attacker-controlled HTTP endpoint. Affected deployments include Red Hat Build of Keycloak, Red Hat Single Sign-On 7, and related Red Hat middleware products. No public exploit code or CISA KEV listing has been identified at time of analysis.
Keycloak's OIDC token introspection endpoint incorrectly discloses the full set of JWT claims to confidential clients inspecting tokens that were not issued for them. Any confidential client configured to receive signed JWT introspection responses can submit a foreign token, receive an 'inactive' status confirmation, and simultaneously receive the complete signed JWT payload containing sensitive user attributes and claims - effectively bypassing the audience isolation that OIDC introspection is designed to enforce. No active exploitation has been confirmed (not listed in CISA KEV), and no public proof-of-concept code has been identified at time of analysis, but the low attack complexity and network accessibility via a standard API endpoint make this a meaningful confidentiality risk in multi-tenant or multi-client Keycloak deployments.
Broken access control in Keycloak's RoleContainerResource component allows delegated administrators with manage-realm permissions to remove child roles from built-in admin roles via name-based endpoints in the admin REST API that skip proper authorization checks. Affected distributions include Red Hat Build of Keycloak, Red Hat Single Sign-On 7, Red Hat JBoss EAP Expansion Pack, and Red Hat Data Grid 8. An attacker exploiting this flaw can degrade or disrupt administrative functions within a realm by stripping essential role assignments from built-in admin roles, effectively undermining the role-based access control structure of the affected deployment. No public exploit code and no CISA KEV listing are associated with this CVE at time of analysis.
SAML HTTP-Redirect binding in Keycloak allows network-based attackers to inject malicious parameters into authentication requests targeting clients configured with wildcard redirect URLs. When a victim user completes authentication, Keycloak appends its legitimate SAML response to the attacker-controlled URL parameters, which can cause susceptible service providers to process the attacker's data instead of the real login assertion - potentially resulting in the victim being logged into the wrong account. No public exploit is identified at time of analysis, and the CVSS score of 3.4 (Low) reflects the high attack complexity and limited integrity-only impact.
Token revocation bypass in Keycloak's TokenManager component allows sessions and user data access to persist after administrative invalidation. The flaw (CWE-862: Missing Authorization) causes client-level 'not-before' revocation policies to be silently skipped when a realm-level revocation policy with an older, non-zero timestamp is already in place - causing the revocation to produce no effect. Authenticated token holders (PR:L) can continue refreshing sessions and querying user information APIs despite explicit administrative revocation. No public exploit identified at time of analysis; KEV status is not confirmed.
Missing authorization in Keycloak's administrative API allows a scoped administrator to exceed their privilege boundary by linking identity providers to organizations they are not authorized to manage. Affected deployments include Red Hat Build of Keycloak, Red Hat Single Sign-On 7, and related Red Hat products. An administrator who holds identity provider management permissions but lacks organization management rights can silently reconfigure authentication flows for organizations outside their administrative scope, potentially redirecting user logins through attacker-controlled providers. No public exploit code exists and this vulnerability is not listed in CISA KEV at time of analysis.
Client policy enforcement in Keycloak is bypassable by any user holding client management privileges who exploits a group-name collision across the group hierarchy. Because the policy engine resolves group membership by display name rather than unique identifier, an attacker can create or join a group in a different part of the hierarchy that shares a name with a privileged policy group, then register or update OAuth/OIDC clients without satisfying the required security hardening profiles. No public exploit has been identified at time of analysis, and active exploitation has not been confirmed by CISA KEV.
Improper handling of HTTP/2 and HTTP/3 Extended CONNECT requests in Netty-based services can downgrade them to ordinary CONNECT requests, enabling request-smuggling or desynchronization in deployments where a fronting proxy and backend interpret the downgraded request differently. The issue carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N), meaning unauthenticated remote attackers can affect integrity, though the independent assessment raises attack complexity to High and scope to Changed and limits practical impact to proxy/gateway mismatches on endpoints that accept HTTP/2 or HTTP/3 Extended CONNECT. No CISA KEV entry or public exploit code was identified at time of analysis, so priority is moderate and conditional rather than urgent.
SMTP command injection in Netty's netty-codec-smtp allows unauthenticated remote attackers to inject arbitrary SMTP commands via CRLF sequences in the command-name field, affecting applications built on Netty such as Red Hat Build of Apache Camel for Spring Boot 4, Red Hat Fuse 7, JBoss EAP 7, and Red Hat Single Sign-On 7. This is an incomplete fix of CVE-2025-59419, requiring attacker-controlled input to reach the SMTP command name and a downstream SMTP server that acts on smuggled commands; no public exploit identified at time of analysis. Integrity impact is high, while confidentiality and availability are unaffected.
Mismatched handling of the HTTP/1 absolute-form request authority in Red Hat build of Quarkus and other affected Red Hat middleware lets a remote, unauthenticated attacker smuggle requests across the HTTP/1-to-HTTP/2 protocol boundary, overriding the :authority pseudo-header that downstream services use for routing and authorization. The vendor CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N = 8.2 High) rates integrity as the dominant impact (I:H) with limited confidentiality exposure (C:L) and no availability effect, consistent with a CWE-444 request-smuggling class defect. Exploitation is not confirmed actively exploited (no CISA KEV listing) and no public exploit identified at time of analysis, although real-world exploitation requires a deployment that actually translates HTTP/1 requests into HTTP/2 and a downstream component that trusts :authority for routing or authorization decisions.
Malformed HTTP/2 CONNECT stream injection in Red Hat JBoss EAP and the wider Red Hat middleware stack (Quarkus, Keycloak, Camel for Spring Boot 4 and Quarkus 3, Data Grid 8, AMQ Broker 7, Fuse 7, Apicurio Registry 3, Debezium 3) lets unauthenticated remote attackers control the :authority of an upstream HTTP/2 CONNECT when the product is deployed as an HTTP/1-to-HTTP/2 translating proxy or gateway. The client-supplied Host header from an HTTP/1 authority-form CONNECT is copied verbatim into the HTTP/2 :authority pseudo-header, so the fronting component and the HTTP/2 backend can disagree about the routing target, yielding an integrity impact (vendor CVSS 3.1 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N; our assessment raises the attack complexity to High and the scope to Changed because a H1→H2 CONNECT translation path and a fronting-proxy topology are required). No public exploit identified at time of analysis, and no EPSS or CISA KEV data was provided.
Netty's codec-rtsp component silently normalizes away trailing control bytes in RTSP method tokens, so a wire request whose method token ends in a byte with code point <= 0x20 immediately before the separating space (for example PLAY\x00 or PLAY\r) is decoded as a fully successful PLAY request with decoderResult().isSuccess() == true and request.method() referencing the same cached singleton object, leaving the application layer unable to distinguish it from a clean PLAY. This is a remote, unauthenticated, low-complexity integrity flaw (CVSS 3.1 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) affecting any product that embeds Netty and exposes an RTSP listener, including the Red Hat components named in the advisory such as AMQ Broker 7, AMQ Clients, Quarkus, Camel for Quarkus 3/Spring Boot 4, Keycloak, JBoss EAP 7/8, Single Sign-On 7, Data Grid 8, Fuse 7, Debezium 3, and Apicurio Registry 3. Real security impact is gated on a downstream disagreement: a front-end proxy, WAF, gateway, or access-control layer must parse the RTSP method differently from Netty for method/request smuggling to produce genuine integrity effects, and exposure is narrow because RTSP listeners are far less commonly internet-facing than HTTP. Exploitation status: no public exploit identified at time of analysis and no CISA KEV confirmation, though the upstream advisory itself documents a minimal wire-level reproduction at a high level.
Remote unauthenticated attackers can exhaust memory in Netty-based services that parse PROXY protocol v2, due to a reference-count leak in the handling of nested TLVs within HAProxyMessageDecoder, leading to denial of service. The flaw is an incomplete fix of upstream PR #16881, so partially patched deployments may remain vulnerable through the grandchild-TLV code path. It affects numerous Red Hat products bundling Netty, such as JBoss EAP 7, Keycloak, and Quarkus, and no public exploit code has been identified at time of analysis.
Unbounded per-connection queue growth in Netty's WebSocketServerExtensionHandler lets unauthenticated remote attackers exhaust server memory (OutOfMemory) and cause denial of service in Red Hat products that bundle the affected Netty code, including AMQ Broker 7, AMQ Clients, Build of Keycloak, Build of Quarkus, Camel for Spring Boot 4, Camel 4 for Quarkus 3, Data Grid 8, Fuse 7, JBoss EAP 7/8, Single Sign-On 7, Apicurio Registry 3 and Debezium 3. The flaw carries CVSS 3.1 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - unauthenticated, no user interaction, availability-only) and is reachable only where a Netty-based server exposes a WebSocket endpoint that negotiates protocol extensions such as permessage-deflate to untrusted clients. No public exploit identified at time of analysis, and no CISA KEV listing; impact is confined to availability, with no confidentiality or integrity loss.
Denial of service in Red Hat's Camel-based and Java middleware products (Red Hat Build of Apache Camel for Spring Boot 4, Red Hat Fuse 7, JBoss EAP 7, and Red Hat Single Sign-On 7): a STOMP frame that declares an oversized content-length is truncated from a 64-bit long to a 32-bit integer, yielding a wrapped/negative length that leaves the STOMP decoder unable to advance, so it loops indefinitely and burns CPU on the affected message-processing thread. The flaw is remotely reachable and unauthenticated per the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5), but exposure is strictly limited to deployments that actually enable a network-reachable STOMP listener - products without a configured STOMP endpoint are not attackable. No confirmed active exploitation (CISA KEV) and no public exploit code identified at time of analysis.
Unbounded heap memory consumption in Netty's HttpServerCodec (io.netty:netty-codec-http) lets a remote, unauthenticated attacker drive a denial of service by exhausting server memory. An attacker who pipelines multiple HTTP/1.1 requests on a single connection and withholds reads prevents the internal methodOverflowQueue from being drained, so memory grows without limit; the assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) is availability-only with no confidentiality or integrity impact, and no public exploit code was identified at time of analysis. Any HTTP/1.1 server built on the default Netty codec behavior is affected, and fixes ship in Netty 4.1.138.Final and 4.2.18.Final, with corresponding patched Red Hat product builds referenced through the Red Hat advisory.
Unbounded remote-initiated stream creation in Netty's SpdySessionHandler allows an unauthenticated, network-positioned attacker to exhaust JVM heap and direct memory on any application that exposes a SPDY endpoint, producing OutOfMemoryError and a denial of service. The handler initializes localConcurrentStreams to Integer.MAX_VALUE and provides no API to change it, so no supported configuration knob reduces the exposure once SPDY is reachable; Netty 4.1.x before 4.1.138.Final and 4.2.x before 4.2.18.Final are affected, along with the Red Hat products that bundle those versions (AMQ Broker and AMQ Clients, Camel for Quarkus 3 and for Spring Boot 4, Keycloak, Quarkus, Debezium, Apicurio Registry, Data Grid, Fuse, JBoss EAP 7/8, and RH-SSO 7). Exploitation requires the target application to have explicitly wired the SPDY handler into its Netty pipeline, since SPDY is a deprecated protocol that is not enabled by default; there is no public exploit identified at time of analysis, and the CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5) reflects a low-complexity, availability-only denial of service with no confidentiality or integrity impact.
Memory exhaustion in Netty's SMTP client response decoder (SmtpResponseDecoder) allows an attacker who controls or can intercept the SMTP server that an application talks to, to force that application to accumulate unlimited multi-line responses until heap is exhausted. The defect is a pure availability issue (C:N/I:N/A:H, CVSS 7.5, AV:N/AC:L/PR:N/UI:N) and is reachable without authentication or user interaction on the victim side, but exploitation is conditional: the vulnerable JVM must have Netty's SMTP client codec active and must establish an SMTP session with a hostile or man-in-the-middle peer, since only server responses are parsed. Shipping products affected through bundled Netty include Red Hat JBoss Enterprise Application Platform 7, Red Hat Fuse 7, Red Hat Single Sign-On 7 and Red Hat Build of Apache Camel for Spring Boot 4; no public exploit code has been identified at time of analysis and there is no confirmed CISA KEV entry.
Heap exhaustion in Netty's Redis array aggregator, as shipped inside Red Hat products such as JBoss Enterprise Application Platform 7, Red Hat Fuse 7, Red Hat Build of Apache Camel for Spring Boot 4, and Red Hat Single Sign-On 7, lets a remote unauthenticated attacker crash the JVM by sending a tiny stream of nested RESP array headers. Because the decoder eagerly allocates an ArrayList sized to the declared array length before any child element arrives, roughly 12 KB of crafted input can reserve about 1.02 billion child slots when the default 1024-level nesting limit and default element limit are in effect; the impact is availability-only, with no data read or modified. Exploitation is limited to deployments that feed attacker-reachable, untrusted RESP/Redis-protocol traffic into the Netty codec with the default constructor; no public exploit code and no confirmed active exploitation were identified at time of analysis.
Denial of service in Netty's MQTT decoder lets unauthenticated remote attackers exhaust server memory and CPU by sending a crafted CONNECT packet whose Properties Length is enormous while its Remaining Length stays small, bypassing the maxBytesInMessage guard that was added to fix CVE-2026-44248. The issue affects any Netty pipeline that runs io.netty.handler.codec.mqtt.MqttDecoder and exposes an MQTT listener; downstream Red Hat products such as AMQ Broker 7, Fuse 7, JBoss EAP 7, Red Hat Single Sign-On 7, and Red Hat Build of Apache Camel for Spring Boot 4 are listed as affected. No public exploit has been identified at time of analysis, and the practical risk is bounded by the need to expose an MQTT endpoint.
Unauthenticated remote attackers can cause a gradual denial of service in applications that use Netty's STOMP codec by sending a STOMP frame body without the terminating null byte; StompSubframeDecoder leaks a ByteBuf for each such frame, so sustained traffic exhausts JVM heap or direct memory. The issue carries CVSS 3.1 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), meaning network-reachable, no authentication or user interaction, availability-only impact. Red Hat middleware products listed in CPE data are affected when STOMP-over-TCP/WebSocket is enabled; no public exploit code or confirmed active exploitation was identified at time of analysis, and a practical DoS requires repeated frames rather than a single packet.
A remote, unauthenticated attacker can exhaust the JVM heap and cause a denial of service by sending a small crafted image to any RESTEasy (JAX-RS) endpoint that consumes an image request body, because the framework's IIOImageProvider decodes the image through ImageIO without validating declared dimensions or pixel count. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) confirms a clean, low-complexity, availability-only flaw with no confidentiality or integrity impact, consistent with CWE-409 data amplification. Reachability is the key limiting factor: only applications that actually expose a resource method consuming image content types through the image provider are affected, and no public exploit code was identified at time of analysis.
Unauthenticated remote memory exhaustion in Keycloak's theme localization endpoints allows any network-reachable attacker to crash the server by flooding the keycloak-services component with unique locale tags, each of which is retained indefinitely in an unbounded in-memory cache. The flaw affects Red Hat Build of Keycloak and Red Hat Single Sign-On 7 deployments where those endpoints are exposed to untrusted networks, and requires no credentials or user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5, CWE-400). Impact is availability-only with no data disclosure or integrity compromise, and no public exploit code has been identified at time of analysis, nor is there confirmed active exploitation (CISA KEV).
Missing authorization enforcement in the Keycloak policy enforcer lets an authenticated user bypass path-based security policies in Red Hat Build of Keycloak and Red Hat Single Sign-On 7 deployments, gaining access to administrative or private application endpoints that the configured policies intended to protect. The flaw lies in how the enforcer normalizes request URLs containing encoded semicolons or directory-traversal segments, causing it to select a less restrictive policy than the one the backend application ultimately resolves to. Exploitation requires a valid account (even low-privileged), network reachability and an application deployed behind the policy enforcer using path-based authorization; no public exploit code was identified at time of analysis and the issue is not confirmed as actively exploited. Red Hat has published errata addressing the defect.
Native memory exhaustion in Keycloak's SAML Redirect Binding allows an unauthenticated remote attacker to degrade or halt the service by repeatedly sending malformed SAML requests that leak zlib-allocated native memory. Red Hat Build of Keycloak, Red Hat Single Sign-On 7, Red Hat Data Grid 8, and the Red Hat JBoss EAP Expansion Pack are all affected because they embed the same SAML handling code. There is no public exploit identified at time of analysis, and the assessed impact is availability-only (CVSS 7.5, C:N/I:N/A:H), consistent with a genuine but bounded denial-of-service condition; vendor errata (RHSA-2026:68276 through RHSA-2026:68280) address the flaw.
Undertow's WebSocket subsystem fails to enforce configurable upper bounds on message buffer sizes and session timeouts, which default to unlimited, allowing unauthenticated remote attackers to exhaust JVM heap memory or hold connections open indefinitely until the server crashes. Affected deployments span Red Hat JBoss EAP 7, Red Hat Fuse 7, Red Hat Build of Apache Camel for Spring Boot 4, and Undertow packages in RHEL 8, 9, and 10. No public exploit code has been identified at time of analysis, though the attack primitive requires no specialized tooling and has no complexity or authentication barrier.
Denial-of-service in Undertow's WebSocket permessage-deflate implementation allows unauthenticated remote attackers to exhaust server memory by sending specially crafted compressed WebSocket messages. The root cause is exponential buffer doubling in the PerMessageDeflateFunction.largerBuffer() method (CWE-770), which triggers unbounded memory allocation with no confirmation of active exploitation at time of analysis. Affected deployments span a broad Red Hat ecosystem including JBoss EAP 7/8, Red Hat Data Grid 8, Apache Camel for Spring Boot 4, and RHEL 8/9/10 packages that bundle Undertow.
WildFly Elytron's password hashing and verification subsystem silently normalizes Unicode input via NFKC before hashing, collapsing fullwidth characters (e.g., U+FF21 'Ａ') to their ASCII equivalents (e.g., 'A'). This allows an unauthenticated remote attacker to authenticate against accounts whose owners believed their passwords contained unique non-ASCII characters by submitting a standard ASCII-only dictionary - the normalization makes the stored hash indistinguishable from its ASCII equivalent. Affected deployments span Red Hat JBoss EAP 7 and 8, Red Hat Build of Keycloak, Red Hat Data Grid 8, and several other Red Hat middleware products that share the Elytron security layer. No public exploit code or CISA KEV listing has been identified at time of analysis.
Account takeover in Red Hat Build of Keycloak allows an unauthenticated attacker to abuse the reset-credentials flow in the keycloak-services component to complete a password reset for any user without ever clicking the emailed verification link, letting them directly set new credentials. Because the mandatory email-ownership check can be bypassed, the flaw yields full control of arbitrary accounts (CVSS 9.1). No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Session hijacking via SAML assertion replay in Keycloak's SAML broker component allows adjacent-network attackers to authenticate as arbitrary users without credentials. When Keycloak is deployed as a SAML broker in IdP-Initiated flow mode, it fails to enforce the SAML OneTimeUse condition, permitting a captured assertion to be submitted multiple times. No public exploit has been identified at time of analysis, and EPSS sits at 0.14% (4th percentile), though SSVC rates technical impact as total - reflecting the full account takeover consequence if the preconditions are met.
Account takeover in Keycloak (Red Hat build of Keycloak, Red Hat Single Sign-On 7) arises because the IdP-initiated SAML SSO endpoint does not verify whether an upstream identity provider is restricted to account-linking-only mode. An attacker who controls a linked upstream identity can drive that endpoint to complete a full login rather than a mere link operation, seizing complete access to the corresponding local user account. Red Hat has shipped fixes; there is no public exploit identified at time of analysis and EPSS exploitation probability is low (0.19%).
Privilege escalation in Keycloak's Dynamic Client Registration (DCR) component allows attackers with standard user accounts and limited Initial Access Tokens to forge administrative roles directly into their own access tokens. The underlying flaw is a missing claim-path validation in the default DCR policy for User Property mappers, which permits writing attacker-controlled values into sensitive internal claim locations that normally carry role and privilege assertions. Successful exploitation enables takeover of other registered OAuth clients, exfiltration of confidential client secrets, and full administrative control over the affected Keycloak realm. No confirmed active exploitation or public exploit code is identified at time of analysis.
URI normalization bypass in Keycloak's Authorization Services PathMatcher allows authenticated low-privilege users to reach administrative or restricted endpoints by appending trailing slashes or matrix parameters to request URIs. Affected deployments include Red Hat Build of Keycloak, Red Hat Single Sign-On 7, Red Hat Data Grid 8, and Red Hat JBoss EAP Expansion Pack. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog, though the high CVSS confidentiality and integrity impact scores reflect meaningful privilege escalation risk in production environments.
Authentication bypass in Red Hat Build of Keycloak (and Red Hat Single Sign-On 7) lets an unauthenticated attacker forge SAML responses to hijack accounts when a SAML identity-provider's metadata was imported without explicit key-usage attributes, causing the keycloak-services identity-brokering engine to silently disable signature validation despite a signing certificate being present. Rated CVSS 9.1 with total technical impact per CISA SSVC, an attacker who knows a victim's external identifier can log in as that user. No public exploit identified at time of analysis, and EPSS is low (0.14%, 4th percentile), indicating the risk is currently theoretical/targeted rather than mass-exploited.
Privilege escalation in Red Hat Build of Keycloak's user creation component exposes environments running Fine-Grained Admin Permissions V2 (FGAP V2) to unauthorized group assignment by scoped sub-administrators. A sub-admin holding only user-create permissions can bypass group-level authorization checks and enroll newly created users into any group - including privileged or sensitive ones - well beyond the sub-admin's delegated scope. SSVC rates technical impact as total and no public exploit has been identified, though the EPSS score of 0.24% (15th percentile) and SSVC exploitation status of 'none' indicate low immediate exploitation likelihood.
Token exchange in Keycloak bypasses Google Workspace domain allowlist restrictions, enabling any valid Google account holder - regardless of their domain - to swap a Google OAuth token for a Keycloak realm token and gain unauthorized access. Affected deployments are those specifically configured to restrict Google-based logins to approved Workspace domains while also having token exchange enabled; both conditions must be present. No public exploit code has been identified at time of analysis, and EPSS sits at 0.20% (10th percentile), consistent with SSVC's exploitation status of 'none', though SSVC rates technical impact as 'total' given that successful exploitation delivers full realm access.
Tenant-restriction bypass in Keycloak's Microsoft identity provider integration allows attackers holding any valid Microsoft OAuth token - even from a completely unrelated Azure AD organization - to authenticate into a Keycloak realm via the token exchange feature. Affected deployments include Red Hat Build of Keycloak, Red Hat Single Sign-On 7, and Red Hat JBoss EAP Expansion Pack. With CVSS PR:L reflecting the need for a valid Microsoft credential (trivially obtained by registering a free Azure tenant), successful exploitation grants high confidentiality and integrity impact within the realm. No public exploit or active exploitation has been identified at time of analysis; EPSS sits at 0.19% (9th percentile), consistent with SSVC exploitation=none.
Signature-verification bypass in Keycloak (and Red Hat's Keycloak-based products such as Red Hat Single Sign-On 7 and Red Hat Build of Keycloak 26.6/26.6.4) lets an attacker holding valid client credentials abuse a JWT algorithm-confusion weakness in the JWT Authorization Grant flow to forge client assertions and mint unauthorized access tokens. The forged tokens allow impersonation of any federated user tied to the affected Identity Provider, yielding unauthorized access and potential privilege escalation. There is no public exploit identified at time of analysis and the issue is not on CISA KEV; Red Hat rates it 8.1 (High).
Privilege escalation in Keycloak allows a limited administrator to become a full realm administrator by importing users with realm-admin role mappings via the POST /admin/realms/{realm}/partialImport endpoint, bypassing Fine-Grained Admin Permissions (FGAP). Exploitation requires a high-privilege authenticated user, and while a proof-of-concept exploit exists, the EPSS score is very low (0.03%) and there is no evidence of active exploitation.
HTTP request smuggling in Undertow (the embedded web server underpinning JBoss EAP, Red Hat Data Grid, and Apache Camel for Spring Boot) allows remote unauthenticated attackers to bypass front-end security controls by prepending whitespace to header lines. Undertow strips leading spaces from the first header line in violation of RFC 7230, creating a parser discrepancy between upstream proxies and the application server. No public exploit identified at time of analysis, and EPSS sits at 0.13% (32nd percentile), but the CVSS 9.1 and broad Red Hat middleware exposure make this a high-value target for chained attacks.
HTTP request smuggling in Undertow allows remote unauthenticated attackers to send `\r\r\r` as a header block terminator, which can desynchronize parsing when Undertow sits behind specific intermediaries such as older Apache Traffic Server or Google Cloud Classic Application Load Balancer. The flaw affects numerous Red Hat distributions of Undertow (JBoss EAP 7/8, Data Grid 8, Fuse 7, Camel for Spring Boot 4, RHEL 8/9/10) and carries a CVSS 9.1, though EPSS is only 0.04% and there is no public exploit identified at time of analysis.
HTTP request smuggling in Red Hat Undertow allows remote unauthenticated attackers to bypass front-end security controls by exploiting parsing discrepancies between Undertow and upstream proxies when handling crafted header names. The flaw (CWE-444) affects Undertow embedded in multiple Red Hat products including JBoss EAP 7/8, Data Grid 8, Fuse 7, and Apache Camel for Spring Boot 4, with Red Hat issuing patches via RHSA-2026:25125 and RHSA-2026:25126. There is no public exploit identified at time of analysis and EPSS is low (0.10%), but CVSS 9.1 and SSVC 'total' technical impact warrant prompt patching of internet-facing deployments.
Stored cross-site scripting in the login theme rendering component of Keycloak (and its downstream Red Hat Build of Keycloak and Red Hat Single Sign-On 7 products) lets a realm administrator inject malicious JavaScript into display fields that is later executed in the browsers of users loading the affected realm's login page. Exploitation requires an authenticated realm administrator (CVSS PR:H) who can both reach the theme display fields and bypass the input-sanitizing security filter, so this is a privilege-abuse or post-compromise vector rather than an anonymous remote attack; impact is limited to the confidentiality and integrity of affected users' sessions (C:L/I:L) with no availability impact. There is no public exploit identified at time of analysis and no CISA KEV listing; overall this is a genuine but modest-priority issue rather than a high-urgency crisis.
Offline tokens issued by Keycloak, Red Hat Build of Keycloak, and Red Hat Single Sign-On 7 can stay valid after a backchannel logout because a serialization bug in the OIDC Dynamic Client Registration (DCR) response omits the backchannel-logout offline-token-revocation setting, silently disabling it whenever a client is updated through the standard update flow (CVE-2026-107623, CVSS 3.1 4.3, CWE-862). The actor must hold client-management/registration privileges (AV:N/PR:L), and the deployment must use DCR and rely on backchannel logout to revoke offline tokens, so this is a loss of a revocation guarantee rather than an account takeover. No public exploit code was identified at time of analysis and the issue is not in CISA KEV; EPSS signal is not available in the supplied data, and the assessed real-world risk remains low.
Keycloak, including the Red Hat Build of Keycloak and Red Hat Single Sign-On 7, exposes the active primary secret of confidential clients to any authenticated realm administrator who holds only the read-only view-clients role. The flaw sits in the installation provider and client registration endpoints, which return client credentials that a read-only administrator should never be able to read; with the leaked secret an attacker can authenticate as the confidential client and inherit its service account permissions across integrated services. Exploitation requires an existing realm administrator account with the view-clients role, so risk scales with how broadly that low-trust role is delegated, and no public exploit has been identified at time of analysis.
Keycloak's SMTP email configuration can silently fall back to unencrypted communication when STARTTLS is enabled, allowing an attacker who can intercept and tamper with traffic between the Keycloak server and its mail relay to capture SMTP credentials and email message content in cleartext. Affected deployments include Red Hat Build of Keycloak and Red Hat Single Sign-On 7 (CVSS 6.5, AV:N/AC:H/PR:N/UI:N), but exploitation is conditional: it requires a man-in-the-middle position on the SMTP path and an instance configured for opportunistic STARTTLS rather than implicit TLS. No public exploit code or confirmed active exploitation has been identified at time of analysis.
Authentication bypass in Keycloak's OIDC Device Authorization Grant flow allows an attacker who already possesses a valid user password to evade a client's configured minimum authentication level, including mandatory multi-factor authentication, and gain unauthorized access to the Keycloak Admin REST API, according to Red Hat. The flaw is a missing enforcement check (CWE-287) affecting Red Hat Build of Keycloak and Red Hat Single Sign-On 7 deployments where the device authorization flow is enabled for a client that requires elevated authentication. Exploitation requires prior credential compromise (CVSS PR:L) and the targeted client must actually mandate MFA or another authentication level; no public exploit code or CISA KEV active exploitation is identified in the available data, and EPSS is not provided. The CVSS score is 5.4 (moderate), with limited confidentiality and integrity impact.
Blind server-side request forgery in the X.509 client-certificate authenticator of Keycloak (and the downstream Red Hat Build of Keycloak and Red Hat Single Sign-On 7) lets an unauthenticated remote attacker induce the server to make outbound requests to URLs specified in a crafted client certificate, before that certificate has been fully validated. The flaw is reachable only when X.509 client-certificate authentication is enabled and certificate revocation checking via CRL Distribution Points or OCSP is configured - a non-default setup, which is why the assessed vector carries AC:H despite PR:N/UI:N. Impact is limited to low confidentiality (the SSRF is blind and no response content is returned to the attacker), and no public exploit has been identified at time of analysis.
Information disclosure and denial of service in Keycloak's X.509 client certificate authenticator occur when CRL Distribution Point checking is enabled and an unauthenticated remote attacker submits a crafted client certificate. The server fails to properly validate file paths from the certificate, allowing limited local file reads and extreme memory consumption that can crash the system; exploitation requires the non-default combination of certificate-based client authentication and CRL checking, and no public exploit was identified at time of analysis.
Keycloak's Micrometer user-event metrics listener can be forced to create unbounded metric time series by unauthenticated remote requests to the identity broker login endpoint with arbitrary provider aliases, leading to memory exhaustion and performance degradation. This is a low-priority issue because exploitation requires the non-default configuration of including the 'idp' tag in the listener, and the impact is limited to a gradual availability degradation (A:L). No public exploit code has been identified at the time of analysis.
Privilege escalation in the Fine-Grained Admin Permissions v2 (FGAP v2) feature of Keycloak lets an authenticated delegated administrator with role-assignment rights grant a composite role whose transitive contents are never inspected, silently conferring full realm administrative control. Exploitation requires that FGAP v2 be enabled for delegated administration, a limited-admin credential holding role-mapping permissions (CVSS vector PR:H), and the presence of a composite role that transitively contains realm-admin privileges within that administrator's assignable scope; the high attack complexity (AC:H) reflects these preconditions rather than any exploitation difficulty, and the resulting impact is a complete confidentiality, integrity, and availability compromise of the realm (CVSS 6.6). No public exploit code and no confirmed active exploitation have been identified at time of analysis, so this should be treated as a genuine but conditional authorization-logic flaw rather than a remotely exploitable takeover.
mTLS holder-of-key certificate binding is not enforced in Keycloak's Standard Token Exchange V2 flow, so an attacker who already holds valid confidential client credentials can obtain a standard, unrestricted token that escapes the certificate-binding protection the deployment believed was in place. Affected distributions include Red Hat Build of Keycloak and Red Hat Single Sign-On 7, and exploitation is conditional on three things being true at once: the attacker must already possess a stolen client secret or key (the CVSS vector rates this PR:L - a precondition the flaw itself does not grant), the deployment must have Standard Token Exchange V2 enabled and in active use, and the deployment must be relying on mTLS holder-of-key binding as a hardening control. No public exploit code has been identified at time of analysis and there is no CISA KEV listing; the assessed vector (AV:N/AC:H/PR:L/UI:N, C:H/I:H/A:N) reflects a genuine but conditional security-control bypass rather than a mass-exploitable flaw, since certificate-bound tokens are a non-default opt-in configuration.
Information disclosure in the Keycloak Admin REST API lets an authenticated delegated administrator holding only basic group/role search privileges enumerate every group assigned to a given role, including groups they are supposed to be unable to see. The flaw (CWE-862, missing authorization) affects the Admin REST API endpoints that return role-to-group mappings in Keycloak, Red Hat Build of Keycloak, and Red Hat Single Sign-On 7, and is rated CVSS 3.1 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) - a read-only confidentiality impact with no integrity or availability effect. It requires valid, privileged-but-scoped credentials and is only meaningful where an organization actually partitions group visibility across delegated admins; there is no public exploit identified at time of analysis and the issue is not confirmed actively exploited (no CISA KEV listing).
Authenticated delegated administrators in Keycloak can reset other users' passwords and take over their accounts when Fine-Grained Admin Permissions (FGAP) are enabled, because the Admin REST API's general user-update path skips the password-reset authorization check that the dedicated credential-reset flow enforces. Red Hat Build of Keycloak and Red Hat Single Sign-On 7 are the affected downstream products, and the flaw is rated 6.6 (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H, CWE-862). Exploitation is conditionally gated rather than internet-facing: it requires a non-default FGAP configuration and an already-provisioned semi-trusted admin holding user-profile edit rights but deliberately denied password-reset rights, making this an insider or lateral privilege-escalation issue; no public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis.
Keycloak's Level of Authentication (LoA) step-up enforcement can fail open: when a relying client requires a higher authentication level for a user who already holds an active session at a lower level, a logic error in session re-evaluation causes Keycloak to issue a token carrying the lower acr/LoA claim instead of forcing the required step-up authentication. The impact is a bounded assurance downgrade rather than unauthenticated access - the attacker must already be authenticated (CVSS PR:L) - but it may grant access to sensitive resources whose authorization decisions trust those claims, with low confidentiality and integrity impact and no availability impact (CVSS:3.1 4.2, AV:N/AC:H/UI:N/S:U/C:L/I:L/A:N). Exploitation depends on a deployment that actually configures per-client step-up/LoA and on a specific session-state and re-evaluation timing; no public exploit code has been identified at time of analysis and this CVE is not listed in CISA KEV.
Second-factor authentication bypass in Keycloak's Conditional OTP authenticator allows an attacker who already possesses a user's password to skip OTP verification by sending a crafted HTTP header, provided the realm is configured to evaluate headers for OTP-skipping without validating their source. This flaw affects Red Hat Build of Keycloak and Red Hat Single Sign-On 7, has a CVSS score of 6.8 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N), and requires a non-default configuration plus a compromised first factor, meaning it is an account-targeted MFA bypass rather than unauthenticated remote compromise. No public exploit has been identified at the time of analysis.
Keycloak's Pushed Authorization Request implementation can allow an authenticated OAuth client to reuse a previously pushed request_uri when the prompt=none silent-authentication path is used, resulting in multiple authorization codes for an already signed-in user. Exploitation requires a live victim session, PAR enabled, and an authenticated low-privilege client (PR:L), with high attack complexity and limited impact; CVSS is 4.2. No public exploit identified at time of analysis, and no CISA KEV confirmation was provided.
Authentication bypass in the Keycloak (Red Hat Build of Keycloak) Kerberos federation provider lets an attacker on the same or adjacent network impersonate the Key Distribution Center and bypass Kerberos password authentication, potentially gaining unauthorized access to user accounts. The flaw only manifests in the specific, non-default configuration where Kerberos PASSWORD authentication is used while SPNEGO is disabled, because that mode never requests a server ticket to verify the KDC's identity. Rated CVSS 3.1 6.8 (AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N), exploitation requires network adjacency and an active on-path spoofing operation; no public exploit code has been identified and the CVE has not been listed as confirmed actively exploited (CISA KEV).
Keycloak's Admin REST API allows authenticated administrators with delegated privileges over a realm to read or modify sensitive client configurations in the master realm by abusing a per-request in-memory cache that resolves clients by unique identifier without verifying realm ownership. The flaw affects Red Hat Build of Keycloak and Red Hat Single Sign-On 7, requires the attacker to hold privileged delegated administration rights and to know or reference a target client's unique ID, and is assessed as a moderate-priority authorization issue rather than a high-CVSS critical defect. No public exploit code was identified at time of analysis, and successful exploitation could expose client credentials or redirect administrative login attempts to malicious sites.
Missing authorization checks in the Keycloak Authorization Services policy evaluation endpoint allow an authenticated delegated administrator with limited viewing privileges to read the full profile and role information of any user in the realm, including email addresses and assigned security roles. This moderate-severity information-disclosure issue affects Red Hat Build of Keycloak and Red Hat Single Sign-On 7. No public exploit code has been identified at time of analysis.
Delegated administrators in Keycloak can bypass fine-grained reset-password restrictions through the Admin REST API's credential-deletion endpoint, deleting a targeted user's password credentials and locking that user out. The flaw (CWE-862) requires an authenticated, provisioned delegated admin who has user-management access but is specifically not granted the manage-credentials/reset-password permission; it is an insider/delegated-tenant privilege-boundary escalation within the admin's reachable user scope, not unauthenticated exploitation, account takeover, or data disclosure. No public exploit code has been identified at time of analysis, and exploitation depends on Keycloak's fine-grained admin permissions model being deployed.
Privilege escalation in the Keycloak Admin REST API allows an already-authenticated delegated administrator to add their own account to a group that carries administrative role mappings, turning scoped, fine-grained management rights into effective control of the entire realm. The group-membership endpoints do not verify whether the target group grants privileged roles (CWE-862, Missing Authorization), so the escalation is a single API call away for anyone holding manage-users or equivalent group-scoped permissions. Reachability is limited: anonymous users and ordinary end-users cannot trigger it, a high-privilege group must already exist in the same realm, and deployments that only use a single super-admin gain nothing new because those actors are already fully privileged. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV. Affected builds include Red Hat Build of Keycloak and Red Hat Single Sign-On 7.
Keycloak's OpenID Connect token refresh path can issue fresh access tokens on behalf of an OIDC client that an administrator has already disabled, because the server restores requested audiences from stored client IDs without re-checking whether that audience client is still enabled. An attacker who already possesses a valid, unexpired refresh token for the affected client can therefore keep obtaining usable access tokens after the client is turned off, but only against resource servers that validate the JWT locally (offline signature/claim checks) rather than calling Keycloak for introspection or userinfo. Scoring is low at CVSS 4.2 (AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N), no public exploit code was identified at time of analysis, and exploitation requires both a live refresh token and a client that was disabled after that token was issued.
HTTP request smuggling in Netty's HTTP/1 decoder lets remote, unauthenticated attackers bypass front-end security controls and reach resources they should not access by sending requests with malformed Transfer-Encoding headers. Netty is a widely embedded Java networking library, so the practical reach spans Red Hat products built on it - AMQ Broker 7, AMQ Clients, Red Hat Build of Keycloak, Red Hat Build of Quarkus, Red Hat Build of Apache Camel (Spring Boot 4 and Quarkus 3), Red Hat Build of Debezium 3, Red Hat Build of Apicurio Registry 3, Red Hat Data Grid 8 and Red Hat Fuse 7 - as well as JBoss EAP 7/8 and Red Hat Single Sign-On 7 per the associated advisory tags. CVSS 3.1 rates it 6.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N), consistent with smuggling-style control bypass rather than full compromise; no public exploit code or confirmed active exploitation was identified at time of analysis, though the flaw is trivially reachable on any exposed HTTP endpoint.
HTTP request smuggling in Netty's netty-codec-http component lets unauthenticated remote attackers bypass front-end security controls by sending a crafted HTTP/1.1 chunk-size token containing whitespace after the hexadecimal digits, which Netty parses differently from other HTTP intermediaries. The flaw carries a CVSS 3.1 base score of 6.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L), meaning no authentication or user interaction is required, but integrity and availability impact is limited; meaningful exploitation generally depends on a multi-tier topology where a proxy, load balancer, or backend parses the chunk-size token inconsistently with Netty. Red Hat ships the affected library across a broad portfolio - including AMQ Broker 7, AMQ Clients, Quarkus, Keycloak and Red Hat Single Sign-On 7, JBoss EAP 7/8, Fuse 7, Data Grid 8, Camel for Spring Boot 4, Camel 4 for Quarkus 3, Apicurio Registry 3 and Debezium 3 - and no public exploit code has been identified at time of analysis, with no confirmed active exploitation (CISA KEV).
HTTP request smuggling and header injection in Netty's HTTP/2 stack (as bundled in multiple Red Hat products) allow remote unauthenticated attackers to bypass security controls and manipulate requests when HTTP/2 traffic is translated to HTTP/1.1. Affected deployments include Red Hat AMQ Broker 7, Camel, Keycloak, Quarkus, Data Grid, Fuse, EAP, Apicurio Registry, and Debezium. Assessed as high severity (CVSS 3.1 base 7.5, AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:N); exploitation requires the specific topology of an HTTP/2-to-HTTP/1.1 translation boundary, and no public exploit was identified at time of analysis.
This is a real but moderate-priority vulnerability whose severity depends almost entirely on deployment topology rather than the raw 6.5 CVSS score. Netty's HTTP decoder lets split or duplicated Transfer-Encoding header fields slip past its final-chunked validation, so an unauthenticated, remote attacker who can send a raw crafted request to a Netty listener that sits in an HTTP chain with a second HTTP parser (reverse proxy, load balancer, CDN, WAF, or upstream/downstream server) can desynchronize the two parsers and smuggle a request (CWE-444). Impact is confined to low confidentiality and integrity loss (C:L/I:L) with no availability impact, no authentication (PR:N) or user interaction (UI:N) is required, and no public exploit identified at time of analysis.
JVM memory exhaustion in the wildfly-elytron-asn1 DERDecoder allows unauthenticated remote attackers to exhaust heap on any service that feeds untrusted DER/ASN.1 bytes into the library, notably SASL authentication flows and X.500 certificate principal parsing. The decoder reads an attacker-supplied length value and attempts a corresponding allocation without validating it against the actual remaining input, so a crafted payload can force an oversized allocation and destabilize or crash the JVM (availability impact only, CVSS 5.9, AV:N/AC:H/PR:N/UI:N/C:N/I:N/A:H, CWE-770). Exploitation is opportunistic rather than deterministic because the AC:H rating means success depends on payload size/repetition relative to the victim's configured heap, and no public exploit code has been identified at time of analysis; the issue is not listed in CISA KEV and no EPSS score was provided. Scope is limited to Red Hat products that bundle the affected elytron-asn1 library, including Red Hat Build of Keycloak, JBoss EAP 7/8 (and EAP XP), Red Hat Single Sign-On 7, Fuse 7, Quarkus, Data Grid 8, Camel, Debezium, and Cryostat.
HTTP request smuggling in Netty's HTTP/1.1 decoder (HttpObjectDecoder and the HttpRequestDecoder built on it) lets remote, unauthenticated attackers send a chunk-size line containing an embedded bare carriage return - for example `0\rX` - because strict chunk-line validation is skipped whenever the size line carries no `;` chunk extension, causing a request-boundary desync when Netty shares a connection with a second HTTP intermediary that frames the message differently. The flaw reaches every application and Red Hat product that embeds Netty, including AMQ Broker 7, AMQ Clients, Quarkus, Camel 4 for Quarkus 3, Camel for Spring Boot 4, Keycloak / Red Hat Single Sign-On, JBoss EAP 7 and 8, Fuse 7, Data Grid 8, Apicurio Registry 3 and Debezium 3, while independent assessment keeps it at CVSS 6.5 with AC:H because a standalone Netty service with no disagreeing proxy in the chain yields little practical smuggling impact. The public report includes a reproducible PoC test harness, but there is no CISA KEV listing and no evidence of active exploitation.
Denial of service in Netty's HTTP/2 HPACK encoder (HpackEncoder) allows an unauthenticated remote attacker to force excessive CPU and memory consumption by sending SETTINGS frames that advertise an oversized MAX_HEADER_TABLE_SIZE, causing the encoder to retain an excessive number of unique header entries. The issue affects applications and Red Hat products that embed Netty and expose an HTTP/2 listener - including JBoss EAP 7 and 8, Keycloak, Red Hat Single Sign-On 7, AMQ Broker 7, Data Grid 8, Fuse 7, Quarkus, Camel 4 for Quarkus 3, Camel for Spring Boot 4, Apicurio Registry 3, and Debezium 3 - while HTTP/1.1-only endpoints are not exposed. Impact is bounded to availability (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L, CVSS 5.3) with no data disclosure or modification; no public exploit code has been identified at time of analysis and there is no confirmed active exploitation.
A signed/unsigned type mismatch in Netty's Memcache binary protocol codec desynchronizes frame boundaries, allowing an unauthenticated, network-positioned attacker to smuggle responses across a shared or proxied memcache connection (CVSS 3.1 base 6.5, Medium). The flaw is reachable only when the Memcache binary codec is explicitly wired into a network-exposed Netty pipeline - a non-default configuration - and the affected code ships inside Red Hat Fuse 7, JBoss Enterprise Application Platform 7, Single Sign-On 7, and the Red Hat Build of Apache Camel for Spring Boot 4. No public exploit code has been identified at time of analysis, and there is no confirmation of active exploitation (not in CISA KEV); impact is limited to confidentiality and integrity (C:L/I:L) with no availability effect.
Keycloak's first broker login flow leaves a temporary account-linking proof behind after a federated identity link is established or manually removed (CWE-613), allowing an attacker who controls the external identity to silently re-establish the link and authenticate as the victim without any further confirmation. The flaw affects Red Hat Build of Keycloak and Red Hat Single Sign-On 7 deployments that use identity brokering, and carries high confidentiality and integrity impact despite a moderate CVSS base of 6.4. No public exploit code was identified at time of analysis and the issue is not listed in CISA KEV.
Keycloak's Dynamic Client Registration endpoint exposes confidential client secrets in cleartext to users holding the view-clients realm management role, violating the principle of least privilege. Affected deployments include Red Hat Build of Keycloak and Red Hat Single Sign-On 7 across all tracked versions. An attacker granted only read-only view-clients access can harvest any confidential OAuth/OIDC client secret via the registration API and subsequently authenticate as that client, escalating their effective permissions within the realm to whatever the compromised client is authorized to do.
Keycloak's Device Authorization Grant flow (RFC 8628) fails to enforce brute-force account lockout during token redemption, allowing an attacker holding an active device authorization session for a locked account to complete the flow and obtain valid access and refresh tokens. Affected deployments include Red Hat Build of Keycloak and Red Hat Single Sign-On 7 across all versions flagged in the CPE data. No public exploit code or CISA KEV listing has been identified at time of analysis, but the flaw silently undermines a core security control intended to stop credential-stuffing and persistent account compromise.
Path traversal in the key provider component of Red Hat Build of Keycloak allows a realm administrator to probe arbitrary filesystem paths by supplying crafted keystore parameters, revealing the existence and readability of server-side files. The vulnerability exists because a prior fix for path probing was incomplete, leaving a residual bypass in the keycloak-services library - the core engine shared by both Red Hat Build of Keycloak and Red Hat Single Sign-On 7. No public exploit code has been identified at time of analysis, and exploitation requires realm administrator credentials, materially limiting opportunistic attack surface.
The AdvertiseListenerImpl component in mod_cluster's core multicast UDP handler can be permanently crashed by a single crafted datagram, affecting Red Hat JBoss Enterprise Application Platform 7 and 8, JBoss Web Server 5 through 7, and Red Hat Single Sign-On 7. An unauthenticated attacker with adjacency to the mod_cluster multicast group can silently terminate the advertise listener thread, causing the affected node to stop receiving cluster topology updates until manually restarted - with no runtime indication of failure since isListening() continues returning true. No public exploit is identified at time of analysis, and this CVE is not listed in the CISA KEV catalog based on available data.
Undertow's HTTP response header writing path silently truncates 16-bit Unicode characters to 8-bit bytes via a narrowing cast in the `writeString()` method, enabling remote unauthenticated attackers to inject ASCII control characters or special symbols into response headers when an application passes unsanitized user-controlled input into those headers. Affected Red Hat distributions include RHEL 8/9/10, JBoss EAP 7, Red Hat Build of Apache Camel for Spring Boot 4, and Red Hat Single Sign-On 7, as reported by Red Hat via Bugzilla #2516038. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
HTTP request smuggling in Undertow's ChunkReader component enables unauthenticated remote attackers to inject out-of-sync requests, bypassing upstream security controls such as authentication layers or reverse-proxy ACLs. Affected deployments include JBoss EAP 7, WildFly, Red Hat Enterprise Linux 8/9/10, Red Hat Data Grid 8, Red Hat Fuse 7, Red Hat Single Sign-On 7, and several Apache Camel-based Red Hat products. No confirmed active exploitation or public proof-of-concept has been identified at time of analysis; the CVSS 5.3 Medium score reflects limited direct impact, though real-world risk in proxy-fronted architectures is meaningfully higher than the score alone suggests.
Unrestricted archive upload in WildFly Core enables authenticated 'deployer' role users to deploy malicious Java archives via HTTP POST requests, potentially achieving arbitrary file reads and further system compromise. Affected products span multiple Red Hat enterprise offerings including JBoss EAP 7 and 8, Red Hat Fuse 7, Process Automation 7, and Single Sign-On 7, all of which embed wildfly-core as a foundational dependency. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Denial of service in WildFly Core (and downstream Red Hat middleware products) allows a remote administrative user to render a server permanently unrecoverable by injecting a malformed payload into the Inet Address field of the Management Model. The injected payload is persisted to standalone.xml, corrupting the configuration file and preventing normal server restart without manual intervention. No public exploit code has been identified at time of analysis, and the vulnerability is limited to users with administrative credentials, reducing its real-world blast radius despite the high availability impact.
Prometheus metric label cardinality exhaustion in Red Hat Build of Keycloak allows any authenticated user to crash the service by flooding its metric store with unique entries. When the Keycloak metrics subsystem is active, failed account operations (such as login attempts referencing nonexistent client IDs) cause raw, unsanitized error strings to be registered as Prometheus label values; because Prometheus stores each unique label combination as a distinct time series, a low-privileged attacker can generate an unbounded number of distinct metric entries, consuming JVM heap until the process crashes or becomes unresponsive. No public exploit code and no CISA KEV listing exist at time of analysis, but the low attack complexity and broad authenticated-user surface make this a realistic denial-of-service risk in any deployment where metrics are enabled.
Keycloak's LDAP storage provider allows delegated administrators to bypass configured search boundaries by supplying a crafted Distinguished Name (DN), exposing account information from unauthorized directory subtrees and triggering unintended user imports into Keycloak local storage. Affected deployments include Red Hat Build of Keycloak, Red Hat Single Sign-On 7, Red Hat Data Grid 8, and the JBoss EAP Expansion Pack. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; exploitation is constrained to authenticated delegated administrators with access to the LDAP federation interface.
Forced logout via unsigned backchannel requests affects Red Hat Build of Keycloak when an OIDC identity provider is configured to skip signature validation. Under this non-default configuration, the backchannel logout endpoint in keycloak-services improperly accepts logout requests lacking any cryptographic signature (CWE-347), violating the OIDC backchannel logout specification. An unauthenticated network attacker who possesses knowledge of a target user's session identifiers can submit a forged unsigned logout request, terminating that session without the user's consent. No public exploit or active exploitation (CISA KEV) has been identified; with CVSS 3.7 and EPSS data absent from the input, this is a low-priority availability-only issue gated by a specific non-default configuration.
Path traversal in WildFly's domain mode LocalFileRepository exposes arbitrary files readable by the Domain Controller process to attackers who have already obtained or compromised a slave host controller. The flaw resides in the wildfly-core/deployment-repository component, where getFile() and getConfigurationFile() fail to canonicalize or bound-check caller-supplied paths before resolving them on disk, enabling directory traversal sequences to escape the configured repository root. No active exploitation is confirmed (not listed in CISA KEV) and no public exploit code has been identified, but successful exploitation yields high-confidence access to sensitive artifacts including keystores, credentials, and configuration files.
Client policy enforcement in Red Hat Build of Keycloak can be bypassed by an authenticated user holding client management permissions, allowing non-compliant OAuth clients to persist in a realm despite administrator-configured security hardening. The bypass exploits improper client state evaluation during update operations: an attacker creates a public client - which passes policy validation - and then updates it to a confidential client type, skipping the re-evaluation that would normally reject a non-compliant confidential client. No public exploit code has been identified and this CVE is not listed in CISA KEV; however, the low attack complexity and broad deployment of Keycloak in enterprise IAM infrastructure elevate its practical significance.
Time-based authorization policy bypass in Red Hat Build of Keycloak permits any low-privileged authenticated user to inject a fabricated timestamp into their authorization request, causing Keycloak's Authorization Services engine to evaluate the forged value instead of the actual server clock. This fully defeats time-based access controls - such as business-hours restrictions - across affected Red Hat products including Keycloak, Single Sign-On 7, Data Grid 8, and JBoss EAP Expansion Pack. No public exploit code has been identified and this CVE is not listed in CISA KEV, but the CVSS High integrity impact accurately reflects that time-gated authorization controls are rendered entirely ineffective against any valid account holder.
The full-scope-disabled client-policy executor in Red Hat Build of Keycloak silently skips enforcement when the fullScopeAllowed attribute is absent from a client registration or update request, allowing a delegated user to create OAuth/OIDC clients with unrestricted scope access. Affected platforms span Red Hat Build of Keycloak, Red Hat Single Sign-On 7, Red Hat Data Grid 8, and JBoss EAP Expansion Pack. An attacker holding delegated registration privileges (CVSS PR:L) can exploit this to issue tokens containing unauthorized role mappings, effectively escalating their effective permissions within any application trusting those tokens. No public exploit code or CISA KEV entry has been identified at time of analysis.
Incomplete HTTP parameter pollution validation in Keycloak's keycloak-services component exposes OIDC authentication flows to session fixation and account confusion attacks. The security check inspects only the query string of redirect URLs while ignoring the URL fragment, enabling an attacker to inject duplicate security parameters when a client is configured with a wildcard redirect URI. No public exploit has been identified at time of analysis; the CVSS score of 3.4 (AC:H, UI:R) correctly reflects that exploitation requires both a permissive wildcard redirect URI configuration and a non-spec-compliant client application that trusts attacker-injected parameters over Keycloak-issued values.
Wildcard domain validation in Keycloak's keycloak-services component can be bypassed by an attacker who controls their connection's reverse DNS, enabling unauthorized client registration or modification against a Keycloak realm. The flaw stems from the system accepting any hostname that merely ends with the configured domain suffix (e.g., 'attackerexample.com' satisfying a '*.example.com' restriction) rather than enforcing true subdomain membership. Exploitation requires high attack complexity due to the reverse DNS control prerequisite, and no public exploit or CISA KEV listing has been identified at the time of analysis.
Incorrect authorization in Keycloak's group policy evaluation allows a low-privileged authenticated user to bypass group membership checks and gain unauthorized access to administrative functions or protected resources. The root cause is a string prefix comparison used to verify child-group membership under an 'extend to child groups' policy: a user in a group whose name shares a leading prefix with a privileged group (e.g., '/admins-external' matching a policy scoped to '/admins') is incorrectly treated as a legitimate child-group member. The CVSS vector (PR:L, I:H) confirms this is an authenticated integrity-bypass with high impact. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Redirect URI policy bypass in Keycloak's secure-client-uris executor enables interception of OAuth authorization codes over unencrypted HTTP connections. The flaw exists because the executor performs only a prefix-string comparison on the redirect URI rather than properly parsing and validating the host component, allowing a specially crafted domain name to satisfy the HTTPS enforcement check while pointing to an attacker-controlled HTTP endpoint. Affected deployments include Red Hat Build of Keycloak, Red Hat Single Sign-On 7, and related Red Hat middleware products. No public exploit code or CISA KEV listing has been identified at time of analysis.
Keycloak's OIDC token introspection endpoint incorrectly discloses the full set of JWT claims to confidential clients inspecting tokens that were not issued for them. Any confidential client configured to receive signed JWT introspection responses can submit a foreign token, receive an 'inactive' status confirmation, and simultaneously receive the complete signed JWT payload containing sensitive user attributes and claims - effectively bypassing the audience isolation that OIDC introspection is designed to enforce. No active exploitation has been confirmed (not listed in CISA KEV), and no public proof-of-concept code has been identified at time of analysis, but the low attack complexity and network accessibility via a standard API endpoint make this a meaningful confidentiality risk in multi-tenant or multi-client Keycloak deployments.
Broken access control in Keycloak's RoleContainerResource component allows delegated administrators with manage-realm permissions to remove child roles from built-in admin roles via name-based endpoints in the admin REST API that skip proper authorization checks. Affected distributions include Red Hat Build of Keycloak, Red Hat Single Sign-On 7, Red Hat JBoss EAP Expansion Pack, and Red Hat Data Grid 8. An attacker exploiting this flaw can degrade or disrupt administrative functions within a realm by stripping essential role assignments from built-in admin roles, effectively undermining the role-based access control structure of the affected deployment. No public exploit code and no CISA KEV listing are associated with this CVE at time of analysis.
SAML HTTP-Redirect binding in Keycloak allows network-based attackers to inject malicious parameters into authentication requests targeting clients configured with wildcard redirect URLs. When a victim user completes authentication, Keycloak appends its legitimate SAML response to the attacker-controlled URL parameters, which can cause susceptible service providers to process the attacker's data instead of the real login assertion - potentially resulting in the victim being logged into the wrong account. No public exploit is identified at time of analysis, and the CVSS score of 3.4 (Low) reflects the high attack complexity and limited integrity-only impact.
Token revocation bypass in Keycloak's TokenManager component allows sessions and user data access to persist after administrative invalidation. The flaw (CWE-862: Missing Authorization) causes client-level 'not-before' revocation policies to be silently skipped when a realm-level revocation policy with an older, non-zero timestamp is already in place - causing the revocation to produce no effect. Authenticated token holders (PR:L) can continue refreshing sessions and querying user information APIs despite explicit administrative revocation. No public exploit identified at time of analysis; KEV status is not confirmed.
Missing authorization in Keycloak's administrative API allows a scoped administrator to exceed their privilege boundary by linking identity providers to organizations they are not authorized to manage. Affected deployments include Red Hat Build of Keycloak, Red Hat Single Sign-On 7, and related Red Hat products. An administrator who holds identity provider management permissions but lacks organization management rights can silently reconfigure authentication flows for organizations outside their administrative scope, potentially redirecting user logins through attacker-controlled providers. No public exploit code exists and this vulnerability is not listed in CISA KEV at time of analysis.
Client policy enforcement in Keycloak is bypassable by any user holding client management privileges who exploits a group-name collision across the group hierarchy. Because the policy engine resolves group membership by display name rather than unique identifier, an attacker can create or join a group in a different part of the hierarchy that shares a name with a privileged policy group, then register or update OAuth/OIDC clients without satisfying the required security hardening profiles. No public exploit has been identified at time of analysis, and active exploitation has not been confirmed by CISA KEV.