Summary
Ein Angreifer kann mehrere Schwachstellen in Keycloak ausnutzen, um Informationen offenzulegen, und um seine Privilegien zu erhöhen.
Product
Keycloak ermöglicht Single Sign-On mit Identity and Access Management für moderne Anwendungen und Dienste.
Vulnerabilities 2
-
Medium 6.5
Keycloak: org.keycloak/keycloak-services: keycloak: privilege escalation via manage-clients permission
A flaw was found in Keycloak. An administrator with `manage-clients` permission can exploit a misconfiguration where this permission is equivalent to `manage-permissions`. This allows the administrator to escalate privileges and gain control over roles, users…
-
Low 2.7
Keycloak-services: keycloak admin rest api: improper access control leads to sensitive role metadata information disclosure
A flaw was found in Keycloak Admin REST (Representational State Transfer) API. This vulnerability allows information disclosure of sensitive role metadata via insufficient authorization checks on the /admin/realms/{realm}/roles endpoint.
Revision history
-
#3
Neue Updates von Red Hat aufgenommen
-
#2
Referenz(en) aufgenommen: EUVD-2026-16307
-
#1
Initiale Fassung
References
-
Keycloak 26.5.6 release notes vom 2026-03-18
https://www.keycloak.org/2026/03/keycloak-2656-released
-
Keycloak GitHub Issue 45653 vom 2026-03-18
https://github.com/keycloak/keycloak/issues/45653
-
Keycloak GitHub Issue 46719 vom 2026-03-18
https://github.com/keycloak/keycloak/issues/46719
-
NIST CVE-2025-14082
https://nvd.nist.gov/vuln/detail/CVE-2025-14082
-
Red Hat Security Advisory RHSA-2026:6477 vom 2026-04-02
https://access.redhat.com/errata/RHSA-2026:6477
-
Red Hat Security Advisory RHSA-2026:6478 vom 2026-04-02
https://access.redhat.com/errata/RHSA-2026:6478