Red Hat Red Hat build of Keycloak 26.0 vulnerabilities
🔔 Create alert RSS Version checker
Published CVEs affecting Red Hat Red Hat build of Keycloak 26.0: 2 record(s), with affected versions and fixes.
CVE-2025-11419
High · 7.5
CWE-770 Dec 23, 2025
Keycloak: keycloak tls client-initiated renegotiation denial of service
A flaw was found in Keycloak. This vulnerability allows an unauthenticated remote attacker to cause a denial of service (DoS) by repeatedly initiating TLS 1.2 client-initiated renegotiation requests to exhaust server CPU resources, making the service unavailable.
CVE-2025-10044
Medium · 4.3
CWE-79 Sep 5, 2025
Keycloak: keycloak error_description injection on error pages
A flaw was found in Keycloak. Keycloak’s account console and other pages accept arbitrary text in the error_description query parameter. This text is directly rendered in error pages without validation or sanitization. While HTML encoding prevents XSS, an attacker can craft URLs with misleading messages (e.g., fake support phone numbers or URLs), which are displayed within the trusted Keycloak UI. This creates a phishing vector, potentially tricking users into contacting malicious actors.