{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "New images are available for Red Hat build of Keycloak 26.4.9 and Red Hat build of Keycloak 26.4.9 Operator, running on OpenShift Container Platform",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Red Hat build of Keycloak is an integrated sign-on solution, available as a Red Hat JBoss Middleware for OpenShift containerized image. The Red Hat build of Keycloak for OpenShift image provides an authentication server that you can use to log in centrally, log out, and register. You can also manage user accounts for web applications, mobile applications, and RESTful web services.\nRed Hat build of Keycloak Operator for OpenShift simplifies deployment and management of Keycloak 26.4.9 clusters.\n\nThis erratum releases new images for Red Hat build of Keycloak 26.4.9 for use within the OpenShift Container Platform cloud computing Platform-as-a-Service (PaaS) for on-premise or private cloud deployments, aligning with the standalone product release.\n\nSecurity fixes:\n* Unauthorized organization registration via improper invitation token validation (CVE-2026-1529)\n* Disabled identity providers are still accepted for JWT Authorization Grant (CVE-2026-1486)\n* Incorrect ownership checks in /uma-policy/ (CVE-2025-14778)\n* Unauthorized modification of unmanaged user attributes by administrators (CVE-2026-0871)\n* keycloak-services: Business logic flaw allows unauthorized token issuance for disabled users (CVE-2025-14559)\n* Limited administrator can retrieve sensitive user attributes via Admin API (CVE-2025-13881)",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:2366",
        "url": "https://access.redhat.com/errata/RHSA-2026:2366"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_2366.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat build of Keycloak 26.4.9 Images Security Update",
    "tracking": {
      "current_release_date": "2026-02-10T12:41:29+00:00",
      "generator": {
        "date": "2026-02-10T12:41:29+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.7.1"
        }
      },
      "id": "RHSA-2026:2366",
      "initial_release_date": "2026-02-09T20:41:06+00:00",
      "revision_history": [
        {
          "date": "2026-02-09T20:41:06+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-02-09T20:41:06+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-02-10T12:41:29+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat build of Keycloak 26.4",
                "product": {
                  "name": "Red Hat build of Keycloak 26.4",
                  "product_id": "9Base-RHBK-26.4",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:build_keycloak:26.4::el9"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat build of Keycloak"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "rhbk/keycloak-rhel9@sha256:3f38533ab14d09b0d86394d73a61f3304eef2a19a65e5d5cf87107794d4fc23b_s390x",
                "product": {
                  "name": "rhbk/keycloak-rhel9@sha256:3f38533ab14d09b0d86394d73a61f3304eef2a19a65e5d5cf87107794d4fc23b_s390x",
                  "product_id": "rhbk/keycloak-rhel9@sha256:3f38533ab14d09b0d86394d73a61f3304eef2a19a65e5d5cf87107794d4fc23b_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/keycloak-rhel9@sha256:3f38533ab14d09b0d86394d73a61f3304eef2a19a65e5d5cf87107794d4fc23b?arch=s390x\u0026repository_url=registry.redhat.io/rhbk/keycloak-rhel9\u0026tag=26.4-11"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "rhbk/keycloak-rhel9-operator@sha256:3fb03c48b66c39429e64eb4f20a110fea755e102285778aae0a8229cb5681be1_s390x",
                "product": {
                  "name": "rhbk/keycloak-rhel9-operator@sha256:3fb03c48b66c39429e64eb4f20a110fea755e102285778aae0a8229cb5681be1_s390x",
                  "product_id": "rhbk/keycloak-rhel9-operator@sha256:3fb03c48b66c39429e64eb4f20a110fea755e102285778aae0a8229cb5681be1_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/keycloak-rhel9-operator@sha256:3fb03c48b66c39429e64eb4f20a110fea755e102285778aae0a8229cb5681be1?arch=s390x\u0026repository_url=registry.redhat.io/rhbk/keycloak-rhel9-operator\u0026tag=26.4-10"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "rhbk/keycloak-rhel9@sha256:71fbf006f8e158fe29b47dfce09757bb004715395c5063b8e317ffd5ef437112_amd64",
                "product": {
                  "name": "rhbk/keycloak-rhel9@sha256:71fbf006f8e158fe29b47dfce09757bb004715395c5063b8e317ffd5ef437112_amd64",
                  "product_id": "rhbk/keycloak-rhel9@sha256:71fbf006f8e158fe29b47dfce09757bb004715395c5063b8e317ffd5ef437112_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/keycloak-rhel9@sha256:71fbf006f8e158fe29b47dfce09757bb004715395c5063b8e317ffd5ef437112?arch=amd64\u0026repository_url=registry.redhat.io/rhbk/keycloak-rhel9\u0026tag=26.4-11"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "rhbk/keycloak-operator-bundle@sha256:fd235c7a4820865af18c35441296ae7d40bbd2eea2f7c7b16d5ce9f658c5653b_amd64",
                "product": {
                  "name": "rhbk/keycloak-operator-bundle@sha256:fd235c7a4820865af18c35441296ae7d40bbd2eea2f7c7b16d5ce9f658c5653b_amd64",
                  "product_id": "rhbk/keycloak-operator-bundle@sha256:fd235c7a4820865af18c35441296ae7d40bbd2eea2f7c7b16d5ce9f658c5653b_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/keycloak-operator-bundle@sha256:fd235c7a4820865af18c35441296ae7d40bbd2eea2f7c7b16d5ce9f658c5653b?arch=amd64\u0026repository_url=registry.redhat.io/rhbk/keycloak-operator-bundle\u0026tag=26.4.9-1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "rhbk/keycloak-rhel9-operator@sha256:aa64ecc958ea5569ba023b51d7df1bbc347f7df459a92a23e8b058ae4622b6d4_amd64",
                "product": {
                  "name": "rhbk/keycloak-rhel9-operator@sha256:aa64ecc958ea5569ba023b51d7df1bbc347f7df459a92a23e8b058ae4622b6d4_amd64",
                  "product_id": "rhbk/keycloak-rhel9-operator@sha256:aa64ecc958ea5569ba023b51d7df1bbc347f7df459a92a23e8b058ae4622b6d4_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/keycloak-rhel9-operator@sha256:aa64ecc958ea5569ba023b51d7df1bbc347f7df459a92a23e8b058ae4622b6d4?arch=amd64\u0026repository_url=registry.redhat.io/rhbk/keycloak-rhel9-operator\u0026tag=26.4-10"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "amd64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "rhbk/keycloak-rhel9@sha256:8df9fbf1320938c3e708241c78796bcc832d1a11b85be78dd37bbc54630e6365_arm64",
                "product": {
                  "name": "rhbk/keycloak-rhel9@sha256:8df9fbf1320938c3e708241c78796bcc832d1a11b85be78dd37bbc54630e6365_arm64",
                  "product_id": "rhbk/keycloak-rhel9@sha256:8df9fbf1320938c3e708241c78796bcc832d1a11b85be78dd37bbc54630e6365_arm64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/keycloak-rhel9@sha256:8df9fbf1320938c3e708241c78796bcc832d1a11b85be78dd37bbc54630e6365?arch=arm64\u0026repository_url=registry.redhat.io/rhbk/keycloak-rhel9\u0026tag=26.4-11"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "rhbk/keycloak-rhel9-operator@sha256:718d63c9de563c7339fc6800d7f014c186467b11b2c9b058f88fa9883283180b_arm64",
                "product": {
                  "name": "rhbk/keycloak-rhel9-operator@sha256:718d63c9de563c7339fc6800d7f014c186467b11b2c9b058f88fa9883283180b_arm64",
                  "product_id": "rhbk/keycloak-rhel9-operator@sha256:718d63c9de563c7339fc6800d7f014c186467b11b2c9b058f88fa9883283180b_arm64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/keycloak-rhel9-operator@sha256:718d63c9de563c7339fc6800d7f014c186467b11b2c9b058f88fa9883283180b?arch=arm64\u0026repository_url=registry.redhat.io/rhbk/keycloak-rhel9-operator\u0026tag=26.4-10"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "arm64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "rhbk/keycloak-rhel9@sha256:7d3668580a61da509f7b473f8df9197548fb71c465eeaaa53802e7d4e99b84fd_ppc64le",
                "product": {
                  "name": "rhbk/keycloak-rhel9@sha256:7d3668580a61da509f7b473f8df9197548fb71c465eeaaa53802e7d4e99b84fd_ppc64le",
                  "product_id": "rhbk/keycloak-rhel9@sha256:7d3668580a61da509f7b473f8df9197548fb71c465eeaaa53802e7d4e99b84fd_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/keycloak-rhel9@sha256:7d3668580a61da509f7b473f8df9197548fb71c465eeaaa53802e7d4e99b84fd?arch=ppc64le\u0026repository_url=registry.redhat.io/rhbk/keycloak-rhel9\u0026tag=26.4-11"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "rhbk/keycloak-rhel9-operator@sha256:bcc01dface0582789dae5eb2919ac8ba5a4f5e3e36909a7983a32a0a05d14ae0_ppc64le",
                "product": {
                  "name": "rhbk/keycloak-rhel9-operator@sha256:bcc01dface0582789dae5eb2919ac8ba5a4f5e3e36909a7983a32a0a05d14ae0_ppc64le",
                  "product_id": "rhbk/keycloak-rhel9-operator@sha256:bcc01dface0582789dae5eb2919ac8ba5a4f5e3e36909a7983a32a0a05d14ae0_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/keycloak-rhel9-operator@sha256:bcc01dface0582789dae5eb2919ac8ba5a4f5e3e36909a7983a32a0a05d14ae0?arch=ppc64le\u0026repository_url=registry.redhat.io/rhbk/keycloak-rhel9-operator\u0026tag=26.4-10"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhbk/keycloak-operator-bundle@sha256:fd235c7a4820865af18c35441296ae7d40bbd2eea2f7c7b16d5ce9f658c5653b_amd64 as a component of Red Hat build of Keycloak 26.4",
          "product_id": "9Base-RHBK-26.4:rhbk/keycloak-operator-bundle@sha256:fd235c7a4820865af18c35441296ae7d40bbd2eea2f7c7b16d5ce9f658c5653b_amd64"
        },
        "product_reference": "rhbk/keycloak-operator-bundle@sha256:fd235c7a4820865af18c35441296ae7d40bbd2eea2f7c7b16d5ce9f658c5653b_amd64",
        "relates_to_product_reference": "9Base-RHBK-26.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhbk/keycloak-rhel9-operator@sha256:3fb03c48b66c39429e64eb4f20a110fea755e102285778aae0a8229cb5681be1_s390x as a component of Red Hat build of Keycloak 26.4",
          "product_id": "9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:3fb03c48b66c39429e64eb4f20a110fea755e102285778aae0a8229cb5681be1_s390x"
        },
        "product_reference": "rhbk/keycloak-rhel9-operator@sha256:3fb03c48b66c39429e64eb4f20a110fea755e102285778aae0a8229cb5681be1_s390x",
        "relates_to_product_reference": "9Base-RHBK-26.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhbk/keycloak-rhel9-operator@sha256:718d63c9de563c7339fc6800d7f014c186467b11b2c9b058f88fa9883283180b_arm64 as a component of Red Hat build of Keycloak 26.4",
          "product_id": "9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:718d63c9de563c7339fc6800d7f014c186467b11b2c9b058f88fa9883283180b_arm64"
        },
        "product_reference": "rhbk/keycloak-rhel9-operator@sha256:718d63c9de563c7339fc6800d7f014c186467b11b2c9b058f88fa9883283180b_arm64",
        "relates_to_product_reference": "9Base-RHBK-26.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhbk/keycloak-rhel9-operator@sha256:aa64ecc958ea5569ba023b51d7df1bbc347f7df459a92a23e8b058ae4622b6d4_amd64 as a component of Red Hat build of Keycloak 26.4",
          "product_id": "9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:aa64ecc958ea5569ba023b51d7df1bbc347f7df459a92a23e8b058ae4622b6d4_amd64"
        },
        "product_reference": "rhbk/keycloak-rhel9-operator@sha256:aa64ecc958ea5569ba023b51d7df1bbc347f7df459a92a23e8b058ae4622b6d4_amd64",
        "relates_to_product_reference": "9Base-RHBK-26.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhbk/keycloak-rhel9-operator@sha256:bcc01dface0582789dae5eb2919ac8ba5a4f5e3e36909a7983a32a0a05d14ae0_ppc64le as a component of Red Hat build of Keycloak 26.4",
          "product_id": "9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:bcc01dface0582789dae5eb2919ac8ba5a4f5e3e36909a7983a32a0a05d14ae0_ppc64le"
        },
        "product_reference": "rhbk/keycloak-rhel9-operator@sha256:bcc01dface0582789dae5eb2919ac8ba5a4f5e3e36909a7983a32a0a05d14ae0_ppc64le",
        "relates_to_product_reference": "9Base-RHBK-26.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhbk/keycloak-rhel9@sha256:3f38533ab14d09b0d86394d73a61f3304eef2a19a65e5d5cf87107794d4fc23b_s390x as a component of Red Hat build of Keycloak 26.4",
          "product_id": "9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:3f38533ab14d09b0d86394d73a61f3304eef2a19a65e5d5cf87107794d4fc23b_s390x"
        },
        "product_reference": "rhbk/keycloak-rhel9@sha256:3f38533ab14d09b0d86394d73a61f3304eef2a19a65e5d5cf87107794d4fc23b_s390x",
        "relates_to_product_reference": "9Base-RHBK-26.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhbk/keycloak-rhel9@sha256:71fbf006f8e158fe29b47dfce09757bb004715395c5063b8e317ffd5ef437112_amd64 as a component of Red Hat build of Keycloak 26.4",
          "product_id": "9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:71fbf006f8e158fe29b47dfce09757bb004715395c5063b8e317ffd5ef437112_amd64"
        },
        "product_reference": "rhbk/keycloak-rhel9@sha256:71fbf006f8e158fe29b47dfce09757bb004715395c5063b8e317ffd5ef437112_amd64",
        "relates_to_product_reference": "9Base-RHBK-26.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhbk/keycloak-rhel9@sha256:7d3668580a61da509f7b473f8df9197548fb71c465eeaaa53802e7d4e99b84fd_ppc64le as a component of Red Hat build of Keycloak 26.4",
          "product_id": "9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:7d3668580a61da509f7b473f8df9197548fb71c465eeaaa53802e7d4e99b84fd_ppc64le"
        },
        "product_reference": "rhbk/keycloak-rhel9@sha256:7d3668580a61da509f7b473f8df9197548fb71c465eeaaa53802e7d4e99b84fd_ppc64le",
        "relates_to_product_reference": "9Base-RHBK-26.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhbk/keycloak-rhel9@sha256:8df9fbf1320938c3e708241c78796bcc832d1a11b85be78dd37bbc54630e6365_arm64 as a component of Red Hat build of Keycloak 26.4",
          "product_id": "9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:8df9fbf1320938c3e708241c78796bcc832d1a11b85be78dd37bbc54630e6365_arm64"
        },
        "product_reference": "rhbk/keycloak-rhel9@sha256:8df9fbf1320938c3e708241c78796bcc832d1a11b85be78dd37bbc54630e6365_arm64",
        "relates_to_product_reference": "9Base-RHBK-26.4"
      }
    ]
  },
  "vulnerabilities": [
    {
      "acknowledgments": [
        {
          "names": [
            "Simone Paganessi"
          ]
        }
      ],
      "cve": "CVE-2025-13881",
      "cwe": {
        "id": "CWE-266",
        "name": "Incorrect Privilege Assignment"
      },
      "discovery_date": "2025-12-02T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2418330"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Keycloak Admin API. This vulnerability allows an administrator with limited privileges to retrieve sensitive custom attributes via the /unmanagedAttributes endpoint, bypassing User Profile visibility settings.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "org.keycloak.services.resources.admin: Keycloak: Limited administrator can retrieve sensitive user attributes via Admin API",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-RHBK-26.4:rhbk/keycloak-operator-bundle@sha256:fd235c7a4820865af18c35441296ae7d40bbd2eea2f7c7b16d5ce9f658c5653b_amd64",
          "9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:3fb03c48b66c39429e64eb4f20a110fea755e102285778aae0a8229cb5681be1_s390x",
          "9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:718d63c9de563c7339fc6800d7f014c186467b11b2c9b058f88fa9883283180b_arm64",
          "9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:aa64ecc958ea5569ba023b51d7df1bbc347f7df459a92a23e8b058ae4622b6d4_amd64",
          "9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:bcc01dface0582789dae5eb2919ac8ba5a4f5e3e36909a7983a32a0a05d14ae0_ppc64le",
          "9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:3f38533ab14d09b0d86394d73a61f3304eef2a19a65e5d5cf87107794d4fc23b_s390x",
          "9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:71fbf006f8e158fe29b47dfce09757bb004715395c5063b8e317ffd5ef437112_amd64",
          "9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:7d3668580a61da509f7b473f8df9197548fb71c465eeaaa53802e7d4e99b84fd_ppc64le",
          "9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:8df9fbf1320938c3e708241c78796bcc832d1a11b85be78dd37bbc54630e6365_arm64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-13881"
        },
        {
          "category": "external",
          "summary": "RHBZ#2418330",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2418330"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-13881",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-13881"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-13881",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-13881"
        }
      ],
      "release_date": "2026-01-27T12:34:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-02-09T20:41:06+00:00",
          "details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.",
          "product_ids": [
            "9Base-RHBK-26.4:rhbk/keycloak-operator-bundle@sha256:fd235c7a4820865af18c35441296ae7d40bbd2eea2f7c7b16d5ce9f658c5653b_amd64",
            "9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:3fb03c48b66c39429e64eb4f20a110fea755e102285778aae0a8229cb5681be1_s390x",
            "9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:718d63c9de563c7339fc6800d7f014c186467b11b2c9b058f88fa9883283180b_arm64",
            "9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:aa64ecc958ea5569ba023b51d7df1bbc347f7df459a92a23e8b058ae4622b6d4_amd64",
            "9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:bcc01dface0582789dae5eb2919ac8ba5a4f5e3e36909a7983a32a0a05d14ae0_ppc64le",
            "9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:3f38533ab14d09b0d86394d73a61f3304eef2a19a65e5d5cf87107794d4fc23b_s390x",
            "9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:71fbf006f8e158fe29b47dfce09757bb004715395c5063b8e317ffd5ef437112_amd64",
            "9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:7d3668580a61da509f7b473f8df9197548fb71c465eeaaa53802e7d4e99b84fd_ppc64le",
            "9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:8df9fbf1320938c3e708241c78796bcc832d1a11b85be78dd37bbc54630e6365_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:2366"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "9Base-RHBK-26.4:rhbk/keycloak-operator-bundle@sha256:fd235c7a4820865af18c35441296ae7d40bbd2eea2f7c7b16d5ce9f658c5653b_amd64",
            "9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:3fb03c48b66c39429e64eb4f20a110fea755e102285778aae0a8229cb5681be1_s390x",
            "9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:718d63c9de563c7339fc6800d7f014c186467b11b2c9b058f88fa9883283180b_arm64",
            "9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:aa64ecc958ea5569ba023b51d7df1bbc347f7df459a92a23e8b058ae4622b6d4_amd64",
            "9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:bcc01dface0582789dae5eb2919ac8ba5a4f5e3e36909a7983a32a0a05d14ae0_ppc64le",
            "9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:3f38533ab14d09b0d86394d73a61f3304eef2a19a65e5d5cf87107794d4fc23b_s390x",
            "9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:71fbf006f8e158fe29b47dfce09757bb004715395c5063b8e317ffd5ef437112_amd64",
            "9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:7d3668580a61da509f7b473f8df9197548fb71c465eeaaa53802e7d4e99b84fd_ppc64le",
            "9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:8df9fbf1320938c3e708241c78796bcc832d1a11b85be78dd37bbc54630e6365_arm64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 2.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "9Base-RHBK-26.4:rhbk/keycloak-operator-bundle@sha256:fd235c7a4820865af18c35441296ae7d40bbd2eea2f7c7b16d5ce9f658c5653b_amd64",
            "9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:3fb03c48b66c39429e64eb4f20a110fea755e102285778aae0a8229cb5681be1_s390x",
            "9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:718d63c9de563c7339fc6800d7f014c186467b11b2c9b058f88fa9883283180b_arm64",
            "9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:aa64ecc958ea5569ba023b51d7df1bbc347f7df459a92a23e8b058ae4622b6d4_amd64",
            "9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:bcc01dface0582789dae5eb2919ac8ba5a4f5e3e36909a7983a32a0a05d14ae0_ppc64le",
            "9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:3f38533ab14d09b0d86394d73a61f3304eef2a19a65e5d5cf87107794d4fc23b_s390x",
            "9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:71fbf006f8e158fe29b47dfce09757bb004715395c5063b8e317ffd5ef437112_amd64",
            "9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:7d3668580a61da509f7b473f8df9197548fb71c465eeaaa53802e7d4e99b84fd_ppc64le",
            "9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:8df9fbf1320938c3e708241c78796bcc832d1a11b85be78dd37bbc54630e6365_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "org.keycloak.services.resources.admin: Keycloak: Limited administrator can retrieve sensitive user attributes via Admin API"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Aytac Kalinci"
          ]
        }
      ],
      "cve": "CVE-2025-14559",
      "cwe": {
        "id": "CWE-840",
        "name": "CWE-840"
      },
      "discovery_date": "2025-12-12T05:25:55.520000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2421711"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the keycloak-services component of Keycloak. This vulnerability allows the issuance of access and refresh tokens for disabled users, leading to unauthorized use of previously revoked privileges, via a business logic vulnerability in the Token Exchange implementation when a privileged client invokes the token exchange flow.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "org.keycloak/keycloak-services: Keycloak keycloak-services: Business logic flaw allows unauthorized token issuance for disabled users",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated Moderate for Red Hat. A business logic flaw in the Token Exchange implementation of Keycloak allows a privileged client with impersonation permission to issue access and refresh tokens for disabled users. This can lead to unauthorized access by former employees or banned users, despite their accounts being deactivated. Exploitation requires an internal high-privileged client and does not involve user interaction or direct authentication by the disabled user.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-RHBK-26.4:rhbk/keycloak-operator-bundle@sha256:fd235c7a4820865af18c35441296ae7d40bbd2eea2f7c7b16d5ce9f658c5653b_amd64",
          "9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:3fb03c48b66c39429e64eb4f20a110fea755e102285778aae0a8229cb5681be1_s390x",
          "9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:718d63c9de563c7339fc6800d7f014c186467b11b2c9b058f88fa9883283180b_arm64",
          "9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:aa64ecc958ea5569ba023b51d7df1bbc347f7df459a92a23e8b058ae4622b6d4_amd64",
          "9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:bcc01dface0582789dae5eb2919ac8ba5a4f5e3e36909a7983a32a0a05d14ae0_ppc64le",
          "9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:3f38533ab14d09b0d86394d73a61f3304eef2a19a65e5d5cf87107794d4fc23b_s390x",
          "9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:71fbf006f8e158fe29b47dfce09757bb004715395c5063b8e317ffd5ef437112_amd64",
          "9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:7d3668580a61da509f7b473f8df9197548fb71c465eeaaa53802e7d4e99b84fd_ppc64le",
          "9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:8df9fbf1320938c3e708241c78796bcc832d1a11b85be78dd37bbc54630e6365_arm64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-14559"
        },
        {
          "category": "external",
          "summary": "RHBZ#2421711",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2421711"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-14559",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-14559"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-14559",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14559"
        }
      ],
      "release_date": "2026-01-21T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-02-09T20:41:06+00:00",
          "details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.",
          "product_ids": [
            "9Base-RHBK-26.4:rhbk/keycloak-operator-bundle@sha256:fd235c7a4820865af18c35441296ae7d40bbd2eea2f7c7b16d5ce9f658c5653b_amd64",
            "9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:3fb03c48b66c39429e64eb4f20a110fea755e102285778aae0a8229cb5681be1_s390x",
            "9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:718d63c9de563c7339fc6800d7f014c186467b11b2c9b058f88fa9883283180b_arm64",
            "9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:aa64ecc958ea5569ba023b51d7df1bbc347f7df459a92a23e8b058ae4622b6d4_amd64",
            "9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:bcc01dface0582789dae5eb2919ac8ba5a4f5e3e36909a7983a32a0a05d14ae0_ppc64le",
            "9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:3f38533ab14d09b0d86394d73a61f3304eef2a19a65e5d5cf87107794d4fc23b_s390x",
            "9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:71fbf006f8e158fe29b47dfce09757bb004715395c5063b8e317ffd5ef437112_amd64",
            "9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:7d3668580a61da509f7b473f8df9197548fb71c465eeaaa53802e7d4e99b84fd_ppc64le",
            "9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:8df9fbf1320938c3e708241c78796bcc832d1a11b85be78dd37bbc54630e6365_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:2366"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, disable the Token Exchange preview feature within your Keycloak deployment if it is not actively required. This can typically be achieved through Keycloak\u0027s administrative console or by adjusting relevant configuration settings. If the Token Exchange feature must remain enabled, ensure that only strictly necessary and highly trusted clients are granted the \u0027impersonation\u0027 permission. Any changes to Keycloak configuration may require a service restart or reload to take effect, which could temporarily impact service availability.",
          "product_ids": [
            "9Base-RHBK-26.4:rhbk/keycloak-operator-bundle@sha256:fd235c7a4820865af18c35441296ae7d40bbd2eea2f7c7b16d5ce9f658c5653b_amd64",
            "9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:3fb03c48b66c39429e64eb4f20a110fea755e102285778aae0a8229cb5681be1_s390x",
            "9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:718d63c9de563c7339fc6800d7f014c186467b11b2c9b058f88fa9883283180b_arm64",
            "9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:aa64ecc958ea5569ba023b51d7df1bbc347f7df459a92a23e8b058ae4622b6d4_amd64",
            "9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:bcc01dface0582789dae5eb2919ac8ba5a4f5e3e36909a7983a32a0a05d14ae0_ppc64le",
            "9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:3f38533ab14d09b0d86394d73a61f3304eef2a19a65e5d5cf87107794d4fc23b_s390x",
            "9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:71fbf006f8e158fe29b47dfce09757bb004715395c5063b8e317ffd5ef437112_amd64",
            "9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:7d3668580a61da509f7b473f8df9197548fb71c465eeaaa53802e7d4e99b84fd_ppc64le",
            "9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:8df9fbf1320938c3e708241c78796bcc832d1a11b85be78dd37bbc54630e6365_arm64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "9Base-RHBK-26.4:rhbk/keycloak-operator-bundle@sha256:fd235c7a4820865af18c35441296ae7d40bbd2eea2f7c7b16d5ce9f658c5653b_amd64",
            "9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:3fb03c48b66c39429e64eb4f20a110fea755e102285778aae0a8229cb5681be1_s390x",
            "9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:718d63c9de563c7339fc6800d7f014c186467b11b2c9b058f88fa9883283180b_arm64",
            "9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:aa64ecc958ea5569ba023b51d7df1bbc347f7df459a92a23e8b058ae4622b6d4_amd64",
            "9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:bcc01dface0582789dae5eb2919ac8ba5a4f5e3e36909a7983a32a0a05d14ae0_ppc64le",
            "9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:3f38533ab14d09b0d86394d73a61f3304eef2a19a65e5d5cf87107794d4fc23b_s390x",
            "9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:71fbf006f8e158fe29b47dfce09757bb004715395c5063b8e317ffd5ef437112_amd64",
            "9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:7d3668580a61da509f7b473f8df9197548fb71c465eeaaa53802e7d4e99b84fd_ppc64le",
            "9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:8df9fbf1320938c3e708241c78796bcc832d1a11b85be78dd37bbc54630e6365_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "org.keycloak/keycloak-services: Keycloak keycloak-services: Business logic flaw allows unauthorized token issuance for disabled users"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Joshua Rogers"
          ]
        }
      ],
      "cve": "CVE-2025-14778",
      "cwe": {
        "id": "CWE-266",
        "name": "Incorrect Privilege Assignment"
      },
      "discovery_date": "2025-12-16T05:01:06.107000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2422600"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Keycloak. A significant Broken Access Control vulnerability exists in the UserManagedPermissionService (UMA Protection API). When updating or deleting a UMA policy associated with multiple resources, the authorization check only verifies the caller\u0027s ownership against the first resource in the policy\u0027s list. This allows a user (Owner A) who owns one resource (RA) to update a shared policy and modify authorization rules for other resources (e.g., RB) in that same policy, even if those other resources are owned by a different user (Owner B). This constitutes a horizontal privilege escalation.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "keycloak: Incorrect ownership checks in /uma-policy/",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-RHBK-26.4:rhbk/keycloak-operator-bundle@sha256:fd235c7a4820865af18c35441296ae7d40bbd2eea2f7c7b16d5ce9f658c5653b_amd64",
          "9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:3fb03c48b66c39429e64eb4f20a110fea755e102285778aae0a8229cb5681be1_s390x",
          "9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:718d63c9de563c7339fc6800d7f014c186467b11b2c9b058f88fa9883283180b_arm64",
          "9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:aa64ecc958ea5569ba023b51d7df1bbc347f7df459a92a23e8b058ae4622b6d4_amd64",
          "9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:bcc01dface0582789dae5eb2919ac8ba5a4f5e3e36909a7983a32a0a05d14ae0_ppc64le",
          "9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:3f38533ab14d09b0d86394d73a61f3304eef2a19a65e5d5cf87107794d4fc23b_s390x",
          "9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:71fbf006f8e158fe29b47dfce09757bb004715395c5063b8e317ffd5ef437112_amd64",
          "9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:7d3668580a61da509f7b473f8df9197548fb71c465eeaaa53802e7d4e99b84fd_ppc64le",
          "9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:8df9fbf1320938c3e708241c78796bcc832d1a11b85be78dd37bbc54630e6365_arm64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-14778"
        },
        {
          "category": "external",
          "summary": "RHBZ#2422600",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2422600"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-14778",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-14778"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-14778",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14778"
        }
      ],
      "release_date": "2026-02-09T18:24:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-02-09T20:41:06+00:00",
          "details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.",
          "product_ids": [
            "9Base-RHBK-26.4:rhbk/keycloak-operator-bundle@sha256:fd235c7a4820865af18c35441296ae7d40bbd2eea2f7c7b16d5ce9f658c5653b_amd64",
            "9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:3fb03c48b66c39429e64eb4f20a110fea755e102285778aae0a8229cb5681be1_s390x",
            "9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:718d63c9de563c7339fc6800d7f014c186467b11b2c9b058f88fa9883283180b_arm64",
            "9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:aa64ecc958ea5569ba023b51d7df1bbc347f7df459a92a23e8b058ae4622b6d4_amd64",
            "9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:bcc01dface0582789dae5eb2919ac8ba5a4f5e3e36909a7983a32a0a05d14ae0_ppc64le",
            "9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:3f38533ab14d09b0d86394d73a61f3304eef2a19a65e5d5cf87107794d4fc23b_s390x",
            "9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:71fbf006f8e158fe29b47dfce09757bb004715395c5063b8e317ffd5ef437112_amd64",
            "9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:7d3668580a61da509f7b473f8df9197548fb71c465eeaaa53802e7d4e99b84fd_ppc64le",
            "9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:8df9fbf1320938c3e708241c78796bcc832d1a11b85be78dd37bbc54630e6365_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:2366"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "9Base-RHBK-26.4:rhbk/keycloak-operator-bundle@sha256:fd235c7a4820865af18c35441296ae7d40bbd2eea2f7c7b16d5ce9f658c5653b_amd64",
            "9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:3fb03c48b66c39429e64eb4f20a110fea755e102285778aae0a8229cb5681be1_s390x",
            "9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:718d63c9de563c7339fc6800d7f014c186467b11b2c9b058f88fa9883283180b_arm64",
            "9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:aa64ecc958ea5569ba023b51d7df1bbc347f7df459a92a23e8b058ae4622b6d4_amd64",
            "9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:bcc01dface0582789dae5eb2919ac8ba5a4f5e3e36909a7983a32a0a05d14ae0_ppc64le",
            "9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:3f38533ab14d09b0d86394d73a61f3304eef2a19a65e5d5cf87107794d4fc23b_s390x",
            "9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:71fbf006f8e158fe29b47dfce09757bb004715395c5063b8e317ffd5ef437112_amd64",
            "9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:7d3668580a61da509f7b473f8df9197548fb71c465eeaaa53802e7d4e99b84fd_ppc64le",
            "9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:8df9fbf1320938c3e708241c78796bcc832d1a11b85be78dd37bbc54630e6365_arm64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "9Base-RHBK-26.4:rhbk/keycloak-operator-bundle@sha256:fd235c7a4820865af18c35441296ae7d40bbd2eea2f7c7b16d5ce9f658c5653b_amd64",
            "9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:3fb03c48b66c39429e64eb4f20a110fea755e102285778aae0a8229cb5681be1_s390x",
            "9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:718d63c9de563c7339fc6800d7f014c186467b11b2c9b058f88fa9883283180b_arm64",
            "9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:aa64ecc958ea5569ba023b51d7df1bbc347f7df459a92a23e8b058ae4622b6d4_amd64",
            "9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:bcc01dface0582789dae5eb2919ac8ba5a4f5e3e36909a7983a32a0a05d14ae0_ppc64le",
            "9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:3f38533ab14d09b0d86394d73a61f3304eef2a19a65e5d5cf87107794d4fc23b_s390x",
            "9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:71fbf006f8e158fe29b47dfce09757bb004715395c5063b8e317ffd5ef437112_amd64",
            "9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:7d3668580a61da509f7b473f8df9197548fb71c465eeaaa53802e7d4e99b84fd_ppc64le",
            "9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:8df9fbf1320938c3e708241c78796bcc832d1a11b85be78dd37bbc54630e6365_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "keycloak: Incorrect ownership checks in /uma-policy/"
    },
    {
      "cve": "CVE-2026-0871",
      "cwe": {
        "id": "CWE-266",
        "name": "Incorrect Privilege Assignment"
      },
      "discovery_date": "2026-01-13T08:32:26.428000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2428881"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "No description is available for this CVE.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "org.keycloak/keycloak-services: Keycloak: Unauthorized modification of unmanaged user attributes by administrators",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated Moderate for Red Hat. An administrator with `manage-users` permission can modify unmanaged user attributes in Keycloak, even when the \"Only administrators can view\" setting is enabled. This bypass requires the realm to be configured with unmanaged attributes set to \"Only administrators can view\" and the administrator to possess `manage-users` permission.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-RHBK-26.4:rhbk/keycloak-operator-bundle@sha256:fd235c7a4820865af18c35441296ae7d40bbd2eea2f7c7b16d5ce9f658c5653b_amd64",
          "9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:3fb03c48b66c39429e64eb4f20a110fea755e102285778aae0a8229cb5681be1_s390x",
          "9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:718d63c9de563c7339fc6800d7f014c186467b11b2c9b058f88fa9883283180b_arm64",
          "9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:aa64ecc958ea5569ba023b51d7df1bbc347f7df459a92a23e8b058ae4622b6d4_amd64",
          "9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:bcc01dface0582789dae5eb2919ac8ba5a4f5e3e36909a7983a32a0a05d14ae0_ppc64le",
          "9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:3f38533ab14d09b0d86394d73a61f3304eef2a19a65e5d5cf87107794d4fc23b_s390x",
          "9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:71fbf006f8e158fe29b47dfce09757bb004715395c5063b8e317ffd5ef437112_amd64",
          "9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:7d3668580a61da509f7b473f8df9197548fb71c465eeaaa53802e7d4e99b84fd_ppc64le",
          "9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:8df9fbf1320938c3e708241c78796bcc832d1a11b85be78dd37bbc54630e6365_arm64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-0871"
        },
        {
          "category": "external",
          "summary": "RHBZ#2428881",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2428881"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-0871",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-0871"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-0871",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0871"
        }
      ],
      "release_date": "2025-01-13T08:08:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-02-09T20:41:06+00:00",
          "details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.",
          "product_ids": [
            "9Base-RHBK-26.4:rhbk/keycloak-operator-bundle@sha256:fd235c7a4820865af18c35441296ae7d40bbd2eea2f7c7b16d5ce9f658c5653b_amd64",
            "9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:3fb03c48b66c39429e64eb4f20a110fea755e102285778aae0a8229cb5681be1_s390x",
            "9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:718d63c9de563c7339fc6800d7f014c186467b11b2c9b058f88fa9883283180b_arm64",
            "9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:aa64ecc958ea5569ba023b51d7df1bbc347f7df459a92a23e8b058ae4622b6d4_amd64",
            "9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:bcc01dface0582789dae5eb2919ac8ba5a4f5e3e36909a7983a32a0a05d14ae0_ppc64le",
            "9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:3f38533ab14d09b0d86394d73a61f3304eef2a19a65e5d5cf87107794d4fc23b_s390x",
            "9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:71fbf006f8e158fe29b47dfce09757bb004715395c5063b8e317ffd5ef437112_amd64",
            "9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:7d3668580a61da509f7b473f8df9197548fb71c465eeaaa53802e7d4e99b84fd_ppc64le",
            "9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:8df9fbf1320938c3e708241c78796bcc832d1a11b85be78dd37bbc54630e6365_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:2366"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "9Base-RHBK-26.4:rhbk/keycloak-operator-bundle@sha256:fd235c7a4820865af18c35441296ae7d40bbd2eea2f7c7b16d5ce9f658c5653b_amd64",
            "9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:3fb03c48b66c39429e64eb4f20a110fea755e102285778aae0a8229cb5681be1_s390x",
            "9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:718d63c9de563c7339fc6800d7f014c186467b11b2c9b058f88fa9883283180b_arm64",
            "9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:aa64ecc958ea5569ba023b51d7df1bbc347f7df459a92a23e8b058ae4622b6d4_amd64",
            "9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:bcc01dface0582789dae5eb2919ac8ba5a4f5e3e36909a7983a32a0a05d14ae0_ppc64le",
            "9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:3f38533ab14d09b0d86394d73a61f3304eef2a19a65e5d5cf87107794d4fc23b_s390x",
            "9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:71fbf006f8e158fe29b47dfce09757bb004715395c5063b8e317ffd5ef437112_amd64",
            "9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:7d3668580a61da509f7b473f8df9197548fb71c465eeaaa53802e7d4e99b84fd_ppc64le",
            "9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:8df9fbf1320938c3e708241c78796bcc832d1a11b85be78dd37bbc54630e6365_arm64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "9Base-RHBK-26.4:rhbk/keycloak-operator-bundle@sha256:fd235c7a4820865af18c35441296ae7d40bbd2eea2f7c7b16d5ce9f658c5653b_amd64",
            "9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:3fb03c48b66c39429e64eb4f20a110fea755e102285778aae0a8229cb5681be1_s390x",
            "9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:718d63c9de563c7339fc6800d7f014c186467b11b2c9b058f88fa9883283180b_arm64",
            "9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:aa64ecc958ea5569ba023b51d7df1bbc347f7df459a92a23e8b058ae4622b6d4_amd64",
            "9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:bcc01dface0582789dae5eb2919ac8ba5a4f5e3e36909a7983a32a0a05d14ae0_ppc64le",
            "9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:3f38533ab14d09b0d86394d73a61f3304eef2a19a65e5d5cf87107794d4fc23b_s390x",
            "9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:71fbf006f8e158fe29b47dfce09757bb004715395c5063b8e317ffd5ef437112_amd64",
            "9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:7d3668580a61da509f7b473f8df9197548fb71c465eeaaa53802e7d4e99b84fd_ppc64le",
            "9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:8df9fbf1320938c3e708241c78796bcc832d1a11b85be78dd37bbc54630e6365_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "org.keycloak/keycloak-services: Keycloak: Unauthorized modification of unmanaged user attributes by administrators"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Reynaldo Immanuel",
            "Joy Gilbert Dan"
          ]
        }
      ],
      "cve": "CVE-2026-1486",
      "cwe": {
        "id": "CWE-358",
        "name": "Improperly Implemented Security Check for Standard"
      },
      "discovery_date": "2026-01-27T13:34:53.016000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2433347"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Keycloak. A vulnerability exists in the jwt-authorization-grant flow where the server fails to verify if an Identity Provider (IdP) is enabled before issuing tokens. The issuer lookup mechanism (lookupIdentityProviderFromIssuer) retrieves the IdP configuration but does not filter for isEnabled=false. If an administrator disables an IdP (e.g., due to a compromise or offboarding), an entity possessing that IdP\u0027s signing key can still generate valid JWT assertions that Keycloak accepts, resulting in the issuance of valid access tokens.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "org.keycloak.protocol.oidc.grants: Disabled identity providers are still accepted for JWT Authorization Grant",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated Important for Red Hat products because Keycloak, when configured with JWT authorization grants, fails to verify the enabled status of an Identity Provider (IdP). An attacker possessing the IdP\u0027s signing key can issue valid access tokens even if the IdP has been administratively disabled, leading to unauthorized access.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-RHBK-26.4:rhbk/keycloak-operator-bundle@sha256:fd235c7a4820865af18c35441296ae7d40bbd2eea2f7c7b16d5ce9f658c5653b_amd64",
          "9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:3fb03c48b66c39429e64eb4f20a110fea755e102285778aae0a8229cb5681be1_s390x",
          "9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:718d63c9de563c7339fc6800d7f014c186467b11b2c9b058f88fa9883283180b_arm64",
          "9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:aa64ecc958ea5569ba023b51d7df1bbc347f7df459a92a23e8b058ae4622b6d4_amd64",
          "9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:bcc01dface0582789dae5eb2919ac8ba5a4f5e3e36909a7983a32a0a05d14ae0_ppc64le",
          "9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:3f38533ab14d09b0d86394d73a61f3304eef2a19a65e5d5cf87107794d4fc23b_s390x",
          "9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:71fbf006f8e158fe29b47dfce09757bb004715395c5063b8e317ffd5ef437112_amd64",
          "9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:7d3668580a61da509f7b473f8df9197548fb71c465eeaaa53802e7d4e99b84fd_ppc64le",
          "9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:8df9fbf1320938c3e708241c78796bcc832d1a11b85be78dd37bbc54630e6365_arm64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-1486"
        },
        {
          "category": "external",
          "summary": "RHBZ#2433347",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2433347"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-1486",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-1486"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-1486",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1486"
        }
      ],
      "release_date": "2026-02-09T18:23:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-02-09T20:41:06+00:00",
          "details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.",
          "product_ids": [
            "9Base-RHBK-26.4:rhbk/keycloak-operator-bundle@sha256:fd235c7a4820865af18c35441296ae7d40bbd2eea2f7c7b16d5ce9f658c5653b_amd64",
            "9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:3fb03c48b66c39429e64eb4f20a110fea755e102285778aae0a8229cb5681be1_s390x",
            "9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:718d63c9de563c7339fc6800d7f014c186467b11b2c9b058f88fa9883283180b_arm64",
            "9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:aa64ecc958ea5569ba023b51d7df1bbc347f7df459a92a23e8b058ae4622b6d4_amd64",
            "9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:bcc01dface0582789dae5eb2919ac8ba5a4f5e3e36909a7983a32a0a05d14ae0_ppc64le",
            "9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:3f38533ab14d09b0d86394d73a61f3304eef2a19a65e5d5cf87107794d4fc23b_s390x",
            "9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:71fbf006f8e158fe29b47dfce09757bb004715395c5063b8e317ffd5ef437112_amd64",
            "9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:7d3668580a61da509f7b473f8df9197548fb71c465eeaaa53802e7d4e99b84fd_ppc64le",
            "9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:8df9fbf1320938c3e708241c78796bcc832d1a11b85be78dd37bbc54630e6365_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:2366"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, administrators should immediately revoke or rotate the signing keys associated with any Identity Provider that has been disabled in Keycloak. This operational control is crucial to prevent unauthorized token issuance by ensuring that compromised or offboarded IdP keys cannot be used to generate valid JWT assertions.",
          "product_ids": [
            "9Base-RHBK-26.4:rhbk/keycloak-operator-bundle@sha256:fd235c7a4820865af18c35441296ae7d40bbd2eea2f7c7b16d5ce9f658c5653b_amd64",
            "9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:3fb03c48b66c39429e64eb4f20a110fea755e102285778aae0a8229cb5681be1_s390x",
            "9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:718d63c9de563c7339fc6800d7f014c186467b11b2c9b058f88fa9883283180b_arm64",
            "9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:aa64ecc958ea5569ba023b51d7df1bbc347f7df459a92a23e8b058ae4622b6d4_amd64",
            "9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:bcc01dface0582789dae5eb2919ac8ba5a4f5e3e36909a7983a32a0a05d14ae0_ppc64le",
            "9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:3f38533ab14d09b0d86394d73a61f3304eef2a19a65e5d5cf87107794d4fc23b_s390x",
            "9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:71fbf006f8e158fe29b47dfce09757bb004715395c5063b8e317ffd5ef437112_amd64",
            "9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:7d3668580a61da509f7b473f8df9197548fb71c465eeaaa53802e7d4e99b84fd_ppc64le",
            "9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:8df9fbf1320938c3e708241c78796bcc832d1a11b85be78dd37bbc54630e6365_arm64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "9Base-RHBK-26.4:rhbk/keycloak-operator-bundle@sha256:fd235c7a4820865af18c35441296ae7d40bbd2eea2f7c7b16d5ce9f658c5653b_amd64",
            "9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:3fb03c48b66c39429e64eb4f20a110fea755e102285778aae0a8229cb5681be1_s390x",
            "9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:718d63c9de563c7339fc6800d7f014c186467b11b2c9b058f88fa9883283180b_arm64",
            "9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:aa64ecc958ea5569ba023b51d7df1bbc347f7df459a92a23e8b058ae4622b6d4_amd64",
            "9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:bcc01dface0582789dae5eb2919ac8ba5a4f5e3e36909a7983a32a0a05d14ae0_ppc64le",
            "9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:3f38533ab14d09b0d86394d73a61f3304eef2a19a65e5d5cf87107794d4fc23b_s390x",
            "9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:71fbf006f8e158fe29b47dfce09757bb004715395c5063b8e317ffd5ef437112_amd64",
            "9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:7d3668580a61da509f7b473f8df9197548fb71c465eeaaa53802e7d4e99b84fd_ppc64le",
            "9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:8df9fbf1320938c3e708241c78796bcc832d1a11b85be78dd37bbc54630e6365_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "org.keycloak.protocol.oidc.grants: Disabled identity providers are still accepted for JWT Authorization Grant"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Reynaldo Immanuel"
          ]
        },
        {
          "names": [
            "Joy Gilbert"
          ],
          "organization": "gwthr"
        }
      ],
      "cve": "CVE-2026-1529",
      "cwe": {
        "id": "CWE-347",
        "name": "Improper Verification of Cryptographic Signature"
      },
      "discovery_date": "2026-01-28T12:29:47.086000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2433783"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Keycloak. An attacker can exploit this vulnerability by modifying the organization ID and target email within a legitimate invitation token\u0027s JSON Web Token (JWT) payload. This lack of cryptographic signature verification allows the attacker to successfully self-register into an unauthorized organization, leading to unauthorized access.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "org.keycloak.services.resources.organizations: Keycloak: Unauthorized organization registration via improper invitation token validation",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-RHBK-26.4:rhbk/keycloak-operator-bundle@sha256:fd235c7a4820865af18c35441296ae7d40bbd2eea2f7c7b16d5ce9f658c5653b_amd64",
          "9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:3fb03c48b66c39429e64eb4f20a110fea755e102285778aae0a8229cb5681be1_s390x",
          "9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:718d63c9de563c7339fc6800d7f014c186467b11b2c9b058f88fa9883283180b_arm64",
          "9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:aa64ecc958ea5569ba023b51d7df1bbc347f7df459a92a23e8b058ae4622b6d4_amd64",
          "9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:bcc01dface0582789dae5eb2919ac8ba5a4f5e3e36909a7983a32a0a05d14ae0_ppc64le",
          "9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:3f38533ab14d09b0d86394d73a61f3304eef2a19a65e5d5cf87107794d4fc23b_s390x",
          "9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:71fbf006f8e158fe29b47dfce09757bb004715395c5063b8e317ffd5ef437112_amd64",
          "9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:7d3668580a61da509f7b473f8df9197548fb71c465eeaaa53802e7d4e99b84fd_ppc64le",
          "9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:8df9fbf1320938c3e708241c78796bcc832d1a11b85be78dd37bbc54630e6365_arm64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-1529"
        },
        {
          "category": "external",
          "summary": "RHBZ#2433783",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2433783"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-1529",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-1529"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-1529",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1529"
        }
      ],
      "release_date": "2026-02-09T18:21:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-02-09T20:41:06+00:00",
          "details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.",
          "product_ids": [
            "9Base-RHBK-26.4:rhbk/keycloak-operator-bundle@sha256:fd235c7a4820865af18c35441296ae7d40bbd2eea2f7c7b16d5ce9f658c5653b_amd64",
            "9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:3fb03c48b66c39429e64eb4f20a110fea755e102285778aae0a8229cb5681be1_s390x",
            "9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:718d63c9de563c7339fc6800d7f014c186467b11b2c9b058f88fa9883283180b_arm64",
            "9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:aa64ecc958ea5569ba023b51d7df1bbc347f7df459a92a23e8b058ae4622b6d4_amd64",
            "9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:bcc01dface0582789dae5eb2919ac8ba5a4f5e3e36909a7983a32a0a05d14ae0_ppc64le",
            "9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:3f38533ab14d09b0d86394d73a61f3304eef2a19a65e5d5cf87107794d4fc23b_s390x",
            "9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:71fbf006f8e158fe29b47dfce09757bb004715395c5063b8e317ffd5ef437112_amd64",
            "9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:7d3668580a61da509f7b473f8df9197548fb71c465eeaaa53802e7d4e99b84fd_ppc64le",
            "9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:8df9fbf1320938c3e708241c78796bcc832d1a11b85be78dd37bbc54630e6365_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:2366"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "9Base-RHBK-26.4:rhbk/keycloak-operator-bundle@sha256:fd235c7a4820865af18c35441296ae7d40bbd2eea2f7c7b16d5ce9f658c5653b_amd64",
            "9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:3fb03c48b66c39429e64eb4f20a110fea755e102285778aae0a8229cb5681be1_s390x",
            "9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:718d63c9de563c7339fc6800d7f014c186467b11b2c9b058f88fa9883283180b_arm64",
            "9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:aa64ecc958ea5569ba023b51d7df1bbc347f7df459a92a23e8b058ae4622b6d4_amd64",
            "9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:bcc01dface0582789dae5eb2919ac8ba5a4f5e3e36909a7983a32a0a05d14ae0_ppc64le",
            "9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:3f38533ab14d09b0d86394d73a61f3304eef2a19a65e5d5cf87107794d4fc23b_s390x",
            "9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:71fbf006f8e158fe29b47dfce09757bb004715395c5063b8e317ffd5ef437112_amd64",
            "9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:7d3668580a61da509f7b473f8df9197548fb71c465eeaaa53802e7d4e99b84fd_ppc64le",
            "9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:8df9fbf1320938c3e708241c78796bcc832d1a11b85be78dd37bbc54630e6365_arm64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "9Base-RHBK-26.4:rhbk/keycloak-operator-bundle@sha256:fd235c7a4820865af18c35441296ae7d40bbd2eea2f7c7b16d5ce9f658c5653b_amd64",
            "9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:3fb03c48b66c39429e64eb4f20a110fea755e102285778aae0a8229cb5681be1_s390x",
            "9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:718d63c9de563c7339fc6800d7f014c186467b11b2c9b058f88fa9883283180b_arm64",
            "9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:aa64ecc958ea5569ba023b51d7df1bbc347f7df459a92a23e8b058ae4622b6d4_amd64",
            "9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:bcc01dface0582789dae5eb2919ac8ba5a4f5e3e36909a7983a32a0a05d14ae0_ppc64le",
            "9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:3f38533ab14d09b0d86394d73a61f3304eef2a19a65e5d5cf87107794d4fc23b_s390x",
            "9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:71fbf006f8e158fe29b47dfce09757bb004715395c5063b8e317ffd5ef437112_amd64",
            "9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:7d3668580a61da509f7b473f8df9197548fb71c465eeaaa53802e7d4e99b84fd_ppc64le",
            "9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:8df9fbf1320938c3e708241c78796bcc832d1a11b85be78dd37bbc54630e6365_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "org.keycloak.services.resources.organizations: Keycloak: Unauthorized organization registration via improper invitation token validation"
    }
  ]
}