Regarding CVE-2026-18963

[Navin Kaushik]

https://access.redhat.com/security/cve/cve-2026-18963

Just wanted to clarify if keycloak version 25 is affected as well?

-Regards,

Navin

[Niko Köbler]

Yes, and it has already been fixed and released with v26.7.2

Please read always the release notes and issues linked within them first!

[Navin Kaushik]

But as per below mentioned linked version 25 is not affected:

https://github.com/keycloak/keycloak/issues/51833#issuecomment-5348639072

I am confused now :(.

-Regards,

Navin

--
You received this message because you are subscribed to the Google Groups "Keycloak User" group.
To unsubscribe from this group and stop receiving emails from it, send an email to keycloak-use...@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/keycloak-user/ed0a855b-781f-4aae-9ac7-ec8279625dd9n%40googlegroups.com.

[Niko Köbler]

Ah, sorry.

Everybody is asking these days, if Keycloak is as well affected, or only RHBK.

That's why I overread the "25".

Like the issue comment says, it was introduced in 26, so I also assume that 25 is not affected.

But running a version 25 has a lot of other flaws, bugs and CVEs and is more than outdated. It's 2 years old, don't run it anymore in production. Update as soon as possible.