SB2026091119 - Multiple vulnerabilities in Red Hat build of Keycloak

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026091119

SB2026091119 - Multiple vulnerabilities in Red Hat build of Keycloak

Published: September 11, 2026

Security Bulletin ID SB2026091119
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 6
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

Medium 33% Low 67%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 6 vulnerabilities.


1) Incorrect Privilege Assignment (CVE-ID: CVE-2025-13881)

CWE-ID: CWE-266 - Incorrect Privilege Assignment

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose sensitive user attributes.

The vulnerability exists due to improper privilege assignment in the Keycloak Admin API when accessing the /unmanagedAttributes endpoint. A remote privileged user can retrieve sensitive custom attributes to disclose sensitive user attributes.

The endpoint bypasses User Profile visibility settings.


2) Incorrect Privilege Assignment (CVE-ID: CVE-2026-0871)

CWE-ID: CWE-266 - Incorrect Privilege Assignment

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to modify unmanaged user attributes.

The vulnerability exists due to improper access control in Keycloak\'s unmanaged user attributes handling when managing user attributes. A remote privileged user can modify unmanaged user attributes despite the configured restriction to modify unmanaged user attributes.

Exploitation requires the realm to have unmanaged attributes configured as \"Only administrators can view\" and the administrator to possess the `manage-users` permission.


3) Incorrect authorization (CVE-ID: CVE-2025-14559)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 8.5 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to obtain access and refresh tokens for disabled users and use previously revoked privileges.

The vulnerability exists due to incorrect authorization in the Token Exchange implementation of the keycloak-services component when a privileged client invokes the token exchange flow. A remote privileged user can invoke the token exchange flow for a disabled user to obtain access and refresh tokens for that user and use previously revoked privileges.


4) Incorrect Privilege Assignment (CVE-ID: CVE-2025-14778)

CWE-ID: CWE-266 - Incorrect Privilege Assignment

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to escalate privileges.

The vulnerability exists due to improper authorization in the UserManagedPermissionService (UMA Protection API) when updating or deleting UMA policies associated with multiple resources. A remote user can update a shared policy to modify authorization rules for resources owned by another user to escalate privileges.

Exploitation requires ownership of the first resource in the policy\'s resource list.


5) Improperly implemented security check for standard (CVE-ID: CVE-2026-1486)

CWE-ID: CWE-358 - Improperly Implemented Security Check for Standard

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to obtain valid access tokens.

The vulnerability exists due to an improperly implemented security check in the jwt-authorization-grant flow when processing JWT assertions from a disabled Identity Provider. A remote user can submit a valid JWT assertion signed with the disabled Identity Provider\'s signing key to obtain valid access tokens.

The issuer lookup mechanism does not filter Identity Provider configurations with isEnabled=false.


6) Improper Verification of Cryptographic Signature (CVE-ID: CVE-2026-1529)

CWE-ID: CWE-347 - Improper Verification of Cryptographic Signature

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to gain unauthorized access to an organization.

The vulnerability exists due to improper verification of cryptographic signatures in Keycloak invitation token validation when processing a modified invitation token JSON Web Token payload. A remote user can modify the organization ID and target email in a legitimate invitation token to gain unauthorized access to an organization.


Remediation

Install update from vendor's website.

References