- Issued:
- 2026-05-20
- Updated:
- 2026-05-20
RHSA-2026:19594 - Security Advisory
Synopsis
Important: Red Hat build of Keycloak 26.2.16 Security Update
Type/Severity
Security Advisory: Important
Topic
New Red Hat build of Keycloak 26.2.16 packages are available from the Customer Portal
Description
Red Hat build of Keycloak 26.2.16 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single sign-on capabilities for web and mobile applications.
Security fixes:
- Denial of Service via specially crafted SAML input (CVE-2026-7307)
- Session fixation in OIDC login flow that can lead to account takeover (CVE-2026-7507)
- Open redirect when using wildcard valid redirect URIs in Keycloak (CVE-2026-7504)
Solution
Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.
Affected Products
- Red Hat build of Keycloak Text-only Advisories x86_64
Fixes
(none)The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.
