Authorization bypass through user-controlled key in Keycloak - CVE-2026-9099
Published: June 29, 2026
Vulnerability identifier: #VU135697
CSH Severity: Low
CVSS v4: 7.4 [CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-9099
CWE-ID: CWE-639
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to escalate privileges and compromise administrative accounts.
The vulnerability exists due to improper access control in the GroupResource.addChild() endpoint within the Admin REST API when handling group reparenting requests. A remote privileged user can reparent a highly privileged group under a managed low-privilege group to escalate privileges and compromise administrative accounts.
Only instances with Fine-Grained Admin Permissions v2 enabled are vulnerable to the described privilege inheritance abuse.
Affected software
Keycloak
Red Hat build of Keycloak
Red Hat build of Keycloak
How to mitigate CVE-2026-9099
Install security update from vendor's website.
Keycloak - update to 26.6.4
Red Hat build of Keycloak - addressed in versions 26.4.13, 26.6.4
Red Hat build of Keycloak - addressed in versions 26.4.13, 26.6.4