# Redhat Build of Keycloak


- [CVE-2026-15572](https://insights.sbomify.com/CVE-2026-15572/): Keycloak-services: keycloak-services: dcr protocol mapper type-swap policy bypass allows privilege escalation (high 8.8)
- [CVE-2026-3047](https://insights.sbomify.com/CVE-2026-3047/): Keycloak SAML Broken has Authentication Bypass by Primary Weakness (high 8.8)
- [CVE-2026-15573](https://insights.sbomify.com/CVE-2026-15573/): Keycloak-services: keycloak-services: authorization bypass via unnormalized uri matching in pathmatcher (high 8.1)
- [CVE-2026-16102](https://insights.sbomify.com/CVE-2026-16102/): Keycloak-services: keycloak-services: default dcr policy allows role forgery via user property mappers (high 8.1)
- [CVE-2026-1609](https://insights.sbomify.com/CVE-2026-1609/): Org.keycloak/keycloak-quarkus-server: keycloak: unauthorized access via jwt authorization grant with disabled users (high 8.1)
- [CVE-2026-11800](https://insights.sbomify.com/CVE-2026-11800/): Org.keycloak:keycloak-services: keycloak: authentication bypass via jwt algorithm confusion (high 8.1)
- [CVE-2026-9800](https://insights.sbomify.com/CVE-2026-9800/): Keycloak-policy-enforcer: keycloak policy enforcer: authorization bypass via incorrect uri comparison (high 8.1)
- [CVE-2026-7504](https://insights.sbomify.com/CVE-2026-7504/): Org.keycloak/keycloak-services: open redirect when using wildcard valid redirect uris in keycloak (high 8.1)
- [CVE-2026-4636](https://insights.sbomify.com/CVE-2026-4636/): Keycloak: keycloak: uma policy bypass allows authenticated users to gain unauthorized access to victim-owned resources. (high 8.1)
- [CVE-2026-2603](https://insights.sbomify.com/CVE-2026-2603/): Keycloak: keycloak: unauthorized authentication via disabled saml identity provider (high 8.1)
- [CVE-2026-3009](https://insights.sbomify.com/CVE-2026-3009/): Keycloak allows authentication using an Identity Provider (IdP) even after it has been disabled by an administrator (high 8.1)
- [CVE-2024-1132](https://insights.sbomify.com/CVE-2024-1132/): Keycloak: path transversal in redirection validation (high 8.1)

---
From sbomify Insights: https://insights.sbomify.com/products/redhat/build-of-keycloak/