New Red Hat build of Keycloak 26.0.10 packages are available from the Customer
 Portal

Red Hat build of Keycloak 26.0.10 is a standalone server, based on the Keycloak
 project, that provides authentication and standards-based single sign-on capabilities for web and mobile applications.

Security fixes:
* Authentication Bypass Due to Missing LDAP Bind After Password Reset in
 Keycloak (CVE-2025-0604)
* Improper Authorization in Keycloak Organization Mapper Allows Unauthorized
 Organization Claims (CVE-2025-1391)

This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

CVE-2025-0604: Improper Authentication (CWE-287)
CVE-2025-1391: Improper Access Control (CWE-284)