Moderate: Red Hat Security Advisory: Red Hat build of Keycloak 26.2.9 Security Update

New Red Hat build of Keycloak 26.2.9 packages are available from the Customer Portal Red Hat build of Keycloak 26.2.9 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single sign-on capabilities for web and mobile applications. Security fixes...

keycloak: Keycloak error_description injection on error pages

A flaw was found in Keycloak. Keycloak’s account console and other pages accept arbitrary text in the errordescription query parameter. This text is directly rendered in error pages without validation or sanitization. While HTML encoding prevents XSS, an attacker can craft URLs with misleading...

Moderate: Red Hat Security Advisory: Red Hat build of Keycloak 26.2.9 Images Security Update

New images are available for Red Hat build of Keycloak 26.2.9 and Red Hat build of Keycloak 26.2.9 Operator, running on OpenShift Container Platform Red Hat build of Keycloak is an integrated sign-on solution, available as a Red Hat JBoss Middleware for OpenShift containerized image. The Red Hat...

Keycloak SMTP Inject Vulnerability

Special characters used during e-mail registration may perform SMTP Injection and unexpectedly send short unwanted e-mails. The email is limited to 64 characters limited local part of the email, so the attack is limited to very shorts emails subject and little data, the example is 60 chars. This...

GHSA-M4J5-5X4R-2XP9 Keycloak SMTP Inject Vulnerability

Special characters used during e-mail registration may perform SMTP Injection and unexpectedly send short unwanted e-mails. The email is limited to 64 characters limited local part of the email, so the attack is limited to very shorts emails subject and little data, the example is 60 chars. This...

CVE-2025-58056 vulnerabilities

Vulnerabilities for packages: strimzi-kafka-operator, celeborn, wavefront-proxy, druid, zipkin, thingsboard, kserve-modelmesh, apache-activemq-artemis, apicurio-registry, apache-pulsar, trino, selenium, flyway, wildfly, opensearch, docker-selenium, akhq, sonarqube, apache-nifi, tez...

GHSA-FGHV-69VJ-QJ49 vulnerabilities

Vulnerabilities for packages: strimzi-kafka-operator, celeborn, wavefront-proxy, druid, zipkin, thingsboard, kserve-modelmesh, apache-activemq-artemis, apicurio-registry, apache-pulsar, trino, selenium, flyway, wildfly, opensearch, docker-selenium, akhq, sonarqube, apache-nifi, tez...

CVE-2025-58056 vulnerabilities

Vulnerabilities for packages: keycloak, sonarqube, selenium, seata, apache-hop-fips, kayenta, celeborn, flyway, tez, akhq, elasticsearch, neo4j, opensearch, hadoop-fips, infinispan, management-api-for-apache-cassandra-4.1, spark-fips, localstack, kayenta-fips, logstash, apache-nifi, thingsboard,...

GHSA-FGHV-69VJ-QJ49 vulnerabilities

Vulnerabilities for packages: keycloak, sonarqube, selenium, seata, apache-hop-fips, kayenta, celeborn, flyway, tez, akhq, elasticsearch, neo4j, opensearch, hadoop-fips, infinispan, management-api-for-apache-cassandra-4.1, spark-fips, localstack, kayenta-fips, logstash, apache-nifi, thingsboard,...

GHSA-XMCW-MV9P-7PQ2 Duplicate Advisory: Keycloak error_description injection on error pages that can trigger phishing attacks

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-27gc-wj6x-9w55. This link is maintained to preserve external references. Original Description A flaw was found in Keycloak. Keycloak’s account console and other pages accept arbitrary text in the errordescriptio...

Duplicate Advisory: Keycloak error_description injection on error pages that can trigger phishing attacks

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-27gc-wj6x-9w55. This link is maintained to preserve external references. Original Description A flaw was found in Keycloak. Keycloak’s account console and other pages accept arbitrary text in the errordescriptio...

CVE-2025-10043

Rejected reason: Considered by the maintainers a bug scenario experienced rather than a vulnerability...

CVE-2025-10044

A flaw was found in Keycloak. Keycloak’s account console and other pages accept arbitrary text in the errordescription query parameter. This text is directly rendered in error pages without validation or sanitization. While HTML encoding prevents XSS, an attacker can craft URLs with misleading...

CVE-2025-10043

...

CVE-2025-10043

CVE-2025-10043 is rejected/not used as stated; not an active vulnerability entry.

CVE-2025-10043

...

CVE-2025-10044 Keycloak: keycloak error_description injection on error pages

A flaw was found in Keycloak. Keycloak’s account console and other pages accept arbitrary text in the errordescription query parameter. This text is directly rendered in error pages without validation or sanitization. While HTML encoding prevents XSS, an attacker can craft URLs with misleading...

CVE-2025-10044 Keycloak: keycloak error_description injection on error pages

A flaw was found in Keycloak. Keycloak’s account console and other pages accept arbitrary text in the errordescription query parameter. This text is directly rendered in error pages without validation or sanitization. While HTML encoding prevents XSS, an attacker can craft URLs with misleading...

CVE-2025-10044

CVE-2025-10044 affects Keycloak: error_description injection on error pages allows arbitrary text to be rendered in the UI, enabling phishing-like messages (e.g., fake support numbers/URLs) without XSS. The issue is mitigated by HTML encoding but still enables deceptive content within the trusted...

CVE-2025-10044 Keycloak: keycloak error_description injection on error pages

A flaw was found in Keycloak. Keycloak’s account console and other pages accept arbitrary text in the errordescription query parameter. This text is directly rendered in error pages without validation or sanitization. While HTML encoding prevents XSS, an attacker can craft URLs with misleading...