RHSA-2026:95761: Important: Red Hat build of Keycloak 26.6.8 Security Update

Red Hat build of Keycloak 26.6.8 is a standalone server, based onthe Keycloak project, that provides authentication andstandards-based single sign-on capabilities for web and mobileapplications.Security fixes: keycloak-services: keycloak-services: Unbounded metric series creation via idp tag on broker login endpoint (CVE-2026-101333) keycloak-services: keycloak-services: Account takeover via authentication race using reset-credentials path (CVE-2026-103112) rhbk/keycloak-rhel9: keycloak-services: Path traversal in X.509 CRL Distribution Point allows arbitrary local file read (CVE-2026-103884) keycloak-services: keycloak-services: Device Authorization Grant bypasses per-client minimum.acr.value enforcement (CVE-2026-105305) keycloak-services: keycloak-services: SMTP STARTTLS plaintext credential and message downgrade (CVE-2026-107121) keycloak-services: keycloak-services: Unauthenticated CPU denial of service via SAML XML dateTime and duration parsing (CVE-2026-107123) keycloak-services: keycloak-services: OIDC logout endpoint session fixation via idtokenhint leading to account takeover (CVE-2026-107124) keycloak-services: keycloak-services: Unauthenticated CPU exhaustion via SAML 1.1 KeyInfo infinite loop (CVE-2026-107602) keycloak-services: keycloak-services: OIDC DCR read-modify-write silently disables offline token revocation (CVE-2026-107623) keycloak-services: keycloak-services: Stored XSS on login page via kcSanitize bypass (CVE-2026-107889) keycloak-services: keycloak-services: Injection of roles into realm default-roles via DCR endpoint (CVE-2026-109081) rhbk/keycloak-rhel9-operator: Jackson-databind: PolymorphicTypeValidator bypass via generic type arguments and array element types in jackson-databind allows arbitrary class instantiation (incomplete fix for CV (CVE-2026-110879) keycloak-services: keycloak-services: Unauthenticated JVM termination via SAML 1.1 AuthorityBinding parsing loop (CVE-2026-110931) keycloak-services: keycloak-services: Unauthenticated persistent disk exhaustion via theme gzip cache (CVE-2026-110932) keycloak-services: keycloak-services: Account takeover via stale SSOAUTH note in Organization identity-first login (CVE-2026-112208) keycloak-services: keycloak-services: UMA Protection API resourceType field not validated — cross-owner resource access (CVE-2026-114232) rhbk/keycloak-rhel9: Keycloak: Privilege escalation to realm administrator via improper authorization in identity provider mapper (CVE-2026-12388) rhbk/keycloak-rhel9: Bouncy Castle for Java: Cryptographic signature bypass in RSA PKCS#1 verification (CVE-2026-12860) bcprov-jdk18on: Bouncy Castle for Java: Denial of Service via lazy ASN.1 sequence processing (CVE-2026-13506) rhbk-openshift-rhel9/rhbk-openshift-rhel9: keycloak-services: OIDC IdP update reuses masked client secret after token URL change (CVE-2026-15943) rhbk-openshift-rhel9/rhbk-openshift-rhel9: keycloak-services: Incomplete fix for CIBA brute-force lockout bypass at token redemption (CVE-2026-16103) rhbk-openshift-rhel9/rhbk-openshift-rhel9: keycloak-services: Group policy extendChildren matches sibling group path prefixes (CVE-2026-18203) rhbk-openshift-rhel9/rhbk-openshift-rhel9: keycloak-services: Client policy source-host wildcard domain matching bypass (CVE-2026-18206) rhbk-openshift-rhel9/rhbk-openshift-rhel9: keycloak-services: Client policy source-group condition bypass via duplicate group name matching (CVE-2026-18207) rhbk-openshift-rhel9/rhbk-openshift-rhel9: keycloak-services: Inactive out-of-audience token introspection leaks signed JWT claim (CVE-2026-18208) rhbk-openshift-rhel9/rhbk-openshift-rhel9: keycloak-services: SAML HTTP-Redirect binding response preserves query string leading to parameter pollution (CVE-2026-18217) rhbk-openshift-rhel9/rhbk-openshift-rhel9: keycloak-services: OIDC backchannel logout accepts unsigned forged logout tokens (CVE-2026-18569) rhbk-openshift-rhel9/rhbk-openshift-rhel9: keycloak-services: Name-only group claims let same-name groups satisfy path-specific group policies (CVE-2026-19608) keycloak/rhbk-openshift-rhel9: wildfly-elytron: Password keyspace reduction via NFKC fullwidth folding (CVE-2026-19611) rhbk-openshift-rhel9/rhbk-openshift-rhel9: keycloak-services: Admin API missing audience check (CVE-2026-19688) rhbk/keycloak-rhel9: Bouncy Castle for Java: Denial of Service via quadratic-time escaping of X.500 distinguished names (CVE-2026-58059) rhbk/keycloak-rhel9: Netty: Information disclosure via CORS Vary header overwrite (CVE-2026-59903) netty-handler: Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext (CVE-2026-75595) rhbk-openshift-rhel9/rhbk-openshift-rhel9: Hibernate ORM: SQL Injection via unescaped JSON path segment allows data exfiltration and authorization bypass (CVE-2026-77874) keycloak/rhbk-openshift-rhel9: keycloak-services: Unauthenticated Denial of Service via SAML SOAP endpoint unbounded XML parsing (CVE-2026-82965) keycloak/rhbk-openshift-rhel9: keycloak-services: Cross-session email verification proof not bound to upstream identity for social providers (CVE-2026-82968) bcpkix-jdk18on: Bouncy Castle for Java: Name Constraints bypass via trailing dot in rfc822Name and URI (CVE-2026-8763) keycloak/rhbk-openshift-rhel9: keycloak-services: Device Authorization Grant issues tokens to brute-force-locked accounts (CVE-2026-88770) rhbk/keycloak-rhel9: keycloak-services: Confidential client secret disclosed to view-clients role via Client Registration GET (CVE-2026-89298) rhbk/keycloak-rhel9-operator: jackson-databind: Denial of Service via unbounded cache growth in TypeDeserializerBase (CVE-2026-91776) jackson-databind: Jackson-databind: Denial of Service via quadratic forward-reference completion (CVE-2026-91777) keycloak/rhbk-openshift-rhel9: keycloak-services: Residual cross-browser account-link proof allows silent re-linking (CVE-2026-92358) keycloak/rhbk-openshift-rhel9: keycloak-services: SAML broker accepts holder-of-key assertions without proof of key possession (CVE-2026-92855) keycloak/rhbk-openshift-rhel9: keycloak-services: SAML broker ignores ProxyRestriction delegation constraints (CVE-2026-92856) keycloak/rhbk-openshift-rhel9: keycloak-services: DCR protocol mapper config not validated, allowing IAT holders to forge sub and aud claims in signed tokens (CVE-2026-92857) netty-codec-http: Netty: Denial of Service via unbounded concurrent SPDY streams (CVE-2026-93488) netty-codec-http: Netty: Denial of Service via unbounded HttpServerCodec HTTP/1.1 pipeline queue (CVE-2026-93491) netty-codec-http2: Netty: HTTP/2 HpackEncoder DoS with large table size (CVE-2026-93492) netty-codec-http: Netty: Unbounded Per-Connection Queue Growth in WebSocketServerExtensionHandler Leads to Denial of Service (CVE-2026-93558) netty-codec-http: Netty: Incomplete validation of malformed Transfer-Encoding allows HTTP request smuggling (CVE-2026-93562) netty-codec-haproxy: Netty: HAProxy PROXY-v2 nested-TLV grandchild ByteBuf reference-count leak (incomplete fix of PR #16881) (CVE-2026-93564) netty-codec-http: Netty RtspDecoder Method-Token Smuggling via Trailing Control Byte (CVE-2026-93565) netty-codec-http: Netty: HTTP Request Smuggling due to control characters in the chunk-size line (CVE-2026-93566) netty-codec-http2: HTTP/1 authority-form CONNECT is translated to malformed HTTP/2 CONNECT with Host-controlled :authority (CVE-2026-93567) netty-codec-http2: Netty: HTTP/2 and HTTP/3 Extended CONNECT requests are downgraded as regular CONNECT requests (CVE-2026-93568) netty-codec-http2: HTTP/1 absolute-form Host mismatch is translated to HTTP/2 :authority, overriding the request-target authority (CVE-2026-93569) netty-codec-http: Netty split Transfer-Encoding fields bypass final-chunked validation and enable request smuggling (CVE-2026-93573) netty-codec-http: Netty: HTTP request smuggling via post-digit whitespace in chunk-size parsing (CVE-2026-93574) netty-codec-http2: Netty: HTTP/2 header field values are not validated by default (CR/LF/NUL passthrough) (CVE-2026-93579) keycloak/rhbk-rhel9-operator: keycloak-core: SAML adapter does not bind signed assertions to the configured identity provider issuer (CVE-2026-93998) keycloak/rhbk-openshift-rhel9: keycloak-services: Token refresh continues issuing tokens for disabled audience clients (CVE-2026-93999) keycloak/rhbk-openshift-rhel9: keycloak-services: Delegated admin with manage-users can escalate to realm-admin via group membership (CVE-2026-94000) keycloak/rhbk-openshift-rhel9: keycloak-services: Admin credential DELETE bypasses denied reset-password permission (CVE-2026-94001) keycloak/rhbk-openshift-rhel9: keycloak-services: Authorization Services policy evaluation endpoint leaks user identity (CVE-2026-94213) keycloak/rhbk-openshift-rhel9: keycloak-services: Cross-realm client read/write via request-level cache missing realm ownership check (CVE-2026-94215) keycloak/rhbk-openshift-rhel9: keycloak-services: UMA scope merge across resource owners via resource name collision (CVE-2026-94217) keycloak/rhbk-openshift-rhel9: keycloak-services: 2FA setup enforcement bypass via authentication session restart endpoint (CVE-2026-94218) keycloak/rhbk-openshift-rhel9: keycloak-services: Potential KDC spoofing bypass when Kerberos password authentication is enabled (CVE-2026-95503) keycloak-services: keycloak-services: Conditional OTP skip-header policy evaluated against untrusted proxy headers (CVE-2026-96445) keycloak-services: keycloak-services: PAR single-use bypass via prompt=none silent authentication path (CVE-2026-96446) keycloak-services: keycloak-services: Stateless token preferredusername fallback enables identity rebinding (CVE-2026-96447) keycloak-services: keycloak-services: FGAP v2 composite-blind role mapping allows privilege escalation (CVE-2026-96448) keycloak-admin-cli: keycloak-admin-cli: kcadm custom truststore accepts arbitrary self-signed certificates (CVE-2026-96453) keycloak-services: keycloak-services: Indefinite access token renewal via Standard Token Exchange V2 (CVE-2026-96460) keycloak-services: keycloak-services: DCR registration-time claim-path gap allows forging realmaccess.roles (CVE-2026-96547) keycloak-services: keycloak-services: CIBA sub parameter injection causes attacker authentication to issue victim tokens (CVE-2026-97174) keycloak-services: keycloak-services: Unverified IdP email auto-linking enables account takeover (CVE-2026-97175) keycloak-services: keycloak-services: Generic user update bypasses denied reset-password permission (CVE-2026-97177) keycloak-services: keycloak-services: Admin REST API role-groups endpoint discloses groups without authorization (CVE-2026-97311) keycloak-services: keycloak-services: DCR azp and sid claim substitution allows Account REST session takeover (CVE-2026-97367) keycloak-services: keycloak-services: Standard Token Exchange V2 bypasses mTLS holder-of-key binding (CVE-2026-97846) keycloak-services: keycloak-services: Client manager can substitute sessionless token principal via hardcoded-claim mappers to obtain realm administrator authority (CVE-2026-97847) keycloak-services: keycloak-services: Protocol mapper with jsonType=JSON bypasses token sanitization (CVE-2026-97848)

— Red Hat