Details:
Red Hat build of Keycloak 26.6.7 is a standalone server, based on
the Keycloak project, that provides authentication and
standards-based single sign-on capabilities for web and mobile
applications.
Security fixes:
- Group hierarchy search discloses hidden parent groups under FGAP v2 (CVE-2026-15945)
- Organization invitation link exposure allows unauthorized member creation (CVE-2026-16072)
- Authorization codes can be retargeted to another client session (CVE-2026-16089)
- Required signed-JWT assertion policy can be bypassed with unsigned assertion headers (CVE-2026-16093)
- Authenticator config endpoint exposes raw reCAPTCHA secrets to view-only admins (CVE-2026-16104)
- Missing per-role authorization on RoleContainerResource composite endpoints (CVE-2026-16105)
- Incorrect authorization in admin role-composite deletion allows delegated admin to remove privileged child roles (CVE-2026-16106)
- Realm default-group reads disclose hidden groups under FGAP v2 (CVE-2026-16108)
- Information disclosure via role-users endpoint bypasses per-user view filter (CVE-2026-17059)
- Privilege escalation via impersonation role allows takeover of realm administrator accounts (CVE-2026-17526)
- RESTeasy SourceProvider remote unauthenticated file read (CVE-2026-17615)
- Generic identity-provider creation can bind brokers to organizations without manage-organizations (CVE-2026-18201)
- OIDC redirect_uri fragment bypass in HTTP parameter pollution check (CVE-2026-18209)
- SAML Redirect DEFLATE helpers leak native zlib state (CVE-2026-18212)
- Google external access-token exchange bypasses hosted-domain restriction (CVE-2026-18214)
- Microsoft external access-token exchange bypasses configured tenant (CVE-2026-18215)
- Client not-before revocation ignored when realm not-before is older but nonzero (CVE-2026-18218)
- Full-scope-disabled client policy validation bypass via omitted fullScopeAllowed (CVE-2026-18570)
- FGAP V2 group assignment bypass during user creation...