The Keycloak Team reports:
- CVE-2026-9793: JWE request object bypasses requestObjectSignatureAlg enforcement
- CVE-2026-4629: Privilege escalation via hardcoded role mapper injection in manage-clients
- CVE-2026-14209: Keycloak Admin UI Extension `brute-force-user` User Disclosure via `search=id:` under FGAP v2
- CVE-2026-14614: Keycloak 26.6.3 Fine-Grained Admin Permissions Bypass in Client Scope Assignment
- CVE-2026-14615: FGAP v2 parent group children endpoint bypasses per-child view permission filter