Important: Keycloak security update
Type/Severity
NetEye Product Security has rated this update as having a high security impact.
Topic
An update for the keycloak packages is now available for NetEye 4.
Security Fix for NetEye 4.50:
26.8.0_neteye1.47.1-1
Summary
This Keycloak update (version 26.8.0) resolves several security issues identified in upstream Keycloak, including those fixed in upstream release 26.7.5:
- CVE-2026-16103: Incomplete fix for CVE-2026-9798 (CIBA brute-force lockout bypass at token redemption)
- CVE-2026-88770: Device Authorization Grant issues tokens to brute-force-locked accounts
- CVE-2026-18206: Client policy source-host wildcard domains match non-subdomain suffixes
- CVE-2026-18203: Group policy child-extension matches sibling group path prefixes
- CVE-2026-18207: Source-group condition matches duplicate group names and can skip negative-logic enforcement
- CVE-2026-18208: Inactive out-of-audience introspection responses can include a signed JWT claim
- CVE-2026-19608: Name-only group claims let same-name groups satisfy path-specific group policies
- CVE-2026-18211: Secure-client-uris localhost exception accepts localhost-prefixed attacker domains
- CVE-2026-18217: SAML Redirect Binding
- CVE-2026-89298: Confidential client secret disclosed to view-clients role via Client Registration
- CVE-2026-93999: Token-exchange refresh continues issuing tokens for a disabled audience client
- CVE-2026-12388: IdP mapper admin rolering
- CVE-2026-14781: OIDC broker applies irinfo email, marking unverifiedaddresses as verified
- CVE-2026-4633: User enumeration via iOrganizations feature is enabled
- CVE-2025-66021: owasp-java-html-sanit
- CVE-2026-84939: Freemarker vulnerability
- CVE-2026-8798, CVE-2026-13505: Bouncys
- CVE-2026-54515, CVE-2026-59889: jacks
- CVE-2026-59903: netty-codec-http vuln
For details on how to apply this update, which includes the changes described in this advisory, refer to the NetEye Update Section in the User Guide.
Affected Products
All NetEye 4.x versions >= 4.38
References
- https://neteye.guide/current/security-policy/bugfix-policy.html#severity-levels
- https://github.com/keycloak/keycloak/releases/tag/26.8.0
- https://github.com/keycloak/keycloak/releases/tag/26.7.5
- https://nvd.nist.gov/vuln/detail/cve-2026-16103
- https://nvd.nist.gov/vuln/detail/cve-2026-88770
- https://nvd.nist.gov/vuln/detail/cve-2026-18206
- https://nvd.nist.gov/vuln/detail/cve-2026-18203
- https://nvd.nist.gov/vuln/detail/cve-2026-18207
- https://nvd.nist.gov/vuln/detail/cve-2026-18208
- https://nvd.nist.gov/vuln/detail/cve-2026-19608
- https://nvd.nist.gov/vuln/detail/cve-2026-18211
- https://nvd.nist.gov/vuln/detail/cve-2026-18217
- https://nvd.nist.gov/vuln/detail/cve-2026-89298
- https://nvd.nist.gov/vuln/detail/cve-2026-93999
- https://nvd.nist.gov/vuln/detail/cve-2026-12388
- https://nvd.nist.gov/vuln/detail/cve-2026-14781
- https://nvd.nist.gov/vuln/detail/cve-2026-4633
- https://nvd.nist.gov/vuln/detail/cve-2025-66021
- https://nvd.nist.gov/vuln/detail/cve-2026-84939
- https://nvd.nist.gov/vuln/detail/cve-2026-8798
- https://nvd.nist.gov/vuln/detail/cve-2026-13505
- https://nvd.nist.gov/vuln/detail/cve-2026-54515
- https://nvd.nist.gov/vuln/detail/cve-2026-59889
- https://nvd.nist.gov/vuln/detail/cve-2026-59903
Luca Tecchio
Software Developer - IT System & Service Management Solutions at Würth IT Italy
Author
