High WID-SEC-2026-0347 7 CVEs

Red Hat Build of Keycloak: Mehrere Schwachstellen

Published Feb 9, 2026 · Updated May 11, 2026 · Revision 3 · de-DE

Vendor: Dell Vendor: Oracle Vendor: Red Hat Product: ECS Product: Enterprise Linux Product: Linux Platform: Linux

Summary

Ein Angreifer kann mehrere Schwachstellen in Red Hat Build of Keycloak ausnutzen, um die Authentifizierung zu umgehen, erweiterte Berechtigungen zu erlangen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen, beliebigen Code auszuführen oder Daten zu manipulieren.

Product

Keycloak ermöglicht Single Sign-On mit Identity and Access Management für moderne Anwendungen und Dienste.

Vulnerabilities 7

High 8.1

CVE-2026-1529 Public exploit

Org.keycloak.services.resources.organizations: keycloak: unauthorized organization registration via improper invitation token validation

A flaw was found in Keycloak. An attacker can exploit this vulnerability by modifying the organization ID and target email within a legitimate invitation token's JSON Web Token (JWT) payload. This lack of cryptographic signature verification allows the attack…

Red Hat Red Hat build of Keycloak 26.4 Red Hat build of Keycloak 26.2 Red Hat build of Keycloak 26.4.9 Wolfi Maven

Feb 9, 2026
High 7.5

CVE-2026-21945

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java S…

Oracle Oracle Java SE Oracle GraalVM Enterprise Edition Oracle GraalVM for JDK Debian Ubuntu Alpine Wolfi

Jan 20, 2026
High 7.1

CVE-2025-64720 Public exploit

LIBPNG is vulnerable to a buffer overflow in `png_image_read_composite` via incorrect palette premultiplication

LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. From version 1.6.0 to before 1.6.51, an out-of-bounds read vulnerability exists in png_image_read_composite when proces…

pnggroup libpng openjpeg2 fltk Debian Ubuntu Azure Linux Alpine Wolfi

Nov 24, 2025
High 7.1

CVE-2025-65018 Public exploit

LIBPNG is vulnerable to a heap buffer overflow in `png_combine_row` triggered via `png_image_finish_read`

LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. From version 1.6.0 to before 1.6.51, there is a heap buffer overflow vulnerability in the libpng simplified API functio…

pnggroup libpng openjpeg2 fltk Debian Ubuntu Azure Linux Alpine Wolfi

Nov 24, 2025
Medium 6.1

CVE-2026-21933

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java S…

Oracle Oracle Java SE Oracle GraalVM Enterprise Edition Oracle GraalVM for JDK Debian Ubuntu Alpine Wolfi

Jan 20, 2026
Medium 5.4

CVE-2025-14778

Keycloak: incorrect ownership checks in /uma-policy/

A flaw was found in Keycloak. A significant Broken Access Control vulnerability exists in the UserManagedPermissionService (UMA Protection API). When updating or deleting a UMA policy associated with multiple resources, the authorization check only verifies t…

Red Hat Red Hat build of Keycloak 26.4 Red Hat build of Keycloak 26.2 Red Hat build of Keycloak 26.4.9 Wolfi Maven

Feb 9, 2026
Medium 4.8

CVE-2026-21925

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java S…

Oracle Oracle Java SE Oracle GraalVM Enterprise Edition Oracle GraalVM for JDK Debian Ubuntu Alpine Wolfi

Jan 20, 2026

Revision history

2026-05-11 #3
Neue Updates von Dell aufgenommen
2026-02-19 #2
Neue Updates von Oracle Linux aufgenommen
2026-02-09 #1
Initiale Fassung

References

Red Hat Security Advisory RHSA-2026:2363 vom 2026-02-09
https://access.redhat.com/errata/RHSA-2026:2363
Red Hat Security Advisory RHSA-2026:2364 vom 2026-02-09
https://access.redhat.com/errata/RHSA-2026:2364
PoC CVE-2025-64720 vom 2026-02-09
https://github.com/dantsco/CVE-2025-64720-PoC
PoC CVE-2025-65018 vom 2026-02-09
https://github.com/Neo-Neo6/CVE-2025-65018-Heap-buffer-overflow-in-libpng-ps4-ps5-
Oracle Linux Security Advisory ELSA-2026-0847 vom 2026-02-20
https://linux.oracle.com/errata/ELSA-2026-0847.html
Dell Security Advisory
https://www.dell.com/support/kbdoc/en-us/000462117/dsa-2026-047-security-update-for-dell-ecs-and-objectscale-multiple-vulnerabilities-1