Medium WID-SEC-2026-2145 3 CVEs

Keycloak: Mehrere Schwachstellen

Published Jun 30, 2026 · Updated Nov 8, 2026 · Revision 5 · de

Vendor: Red Hat Product: Enterprise Linux

Summary

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Keycloak ausnutzen, um Administratorrechte zu erlangen, Sicherheitsmaßnahmen zu umgehen und vertrauliche Informationen offenzulegen.

Product

Keycloak ermöglicht Single Sign-On mit Identity and Access Management für moderne Anwendungen und Dienste.

Vulnerabilities 3

Medium 6.5

CVE-2026-12388

Keycloak-broker: keycloak: privilege escalation to realm administrator via improper authorization in identity provider mapper

A flaw was found in the Identity Provider (IdP) mapper component of Keycloak, which is used to manage how user information from external services is mapped to Keycloak users. An administrator with limited permissions to manage identity providers can exploit t…

Red Hat Red Hat build of Keycloak 26.6 Red Hat build of Keycloak 26.6.8

Jun 30, 2026
Medium 6.5

CVE-2026-4629

Keycloak: keycloak: privilege escalation through hardcoded role mapper injection

A flaw was found in Keycloak. A highly privileged user with `manage-clients` permission can exploit this vulnerability by injecting a hardcoded role mapper into any client. This action allows the user to bypass existing scope restrictions and inject the `real…

Red Hat Red Hat build of Keycloak 26.4 Red Hat build of Keycloak 26.6.5 Red Hat build of Keycloak 26.4.14

Jun 30, 2026
Medium 4.3

CVE-2026-14209

Keycloak-admin-ui: keycloak-admin-ui:admin ui extension brute-force-user endpoint bypasses fgapv2 user view restrictions

A vulnerability was discovered in Keycloak's Admin UI extension that allows certain administrative users to bypass security restrictions. When Fine-Grained Admin Permissions (FGAPv2) are enabled, an administrator who should only be able to search for users (b…

Red Hat Red Hat JBoss Enterprise Application Platform Expansion Pack Red Hat build of Keycloak 26.6 Red Hat build of Keycloak 26.4

Jun 30, 2026

Revision history

2026-11-08 #5
Neue Updates von Red Hat aufgenommen
2026-11-05 #4
Neue Updates von Red Hat aufgenommen
2026-09-30 #3
Neue Updates aufgenommen
2026-08-05 #2
Neue Updates von Red Hat aufgenommen
2026-06-30 #1
Initiale Fassung

References

GitHub Security Advisory GHSA-xmfr-m52w-m2hx vom 2026-06-30
https://github.com/advisories/GHSA-xmfr-m52w-m2hx
GitHub Security Advisory GHSA-M4J4-8CHJ-8G5F vom 2026-06-30
https://github.com/advisories/GHSA-M4J4-8CHJ-8G5F
GitHub Security Advisory GHSA-JXQV-2JJX-692H vom 2026-06-30
https://github.com/advisories/GHSA-JXQV-2JJX-692H
EUVD Security Advisory vom 2026-06-30
https://euvd.enisa.europa.eu/enisa/EUVD-2026-40299
EUVD Security Advisory vom 2026-06-30
https://euvd.enisa.europa.eu/enisa/EUVD-2026-40300
EUVD Security Advisory vom 2026-06-30
https://euvd.enisa.europa.eu/enisa/EUVD-2026-40301
Red Hat Security Advisory RHSA-2026:50847 vom 2026-08-05
https://access.redhat.com/errata/RHSA-2026:50847
Red Hat Security Advisory RHSA-2026:50846 vom 2026-08-05
https://access.redhat.com/errata/RHSA-2026:50846
Red Hat Security Advisory RHSA-2026:50849 vom 2026-08-05
https://access.redhat.com/errata/RHSA-2026:50849
Red Hat Security Advisory RHSA-2026:50848 vom 2026-08-05
https://access.redhat.com/errata/RHSA-2026:50848
Keycloak 26.8.0 released vom 2026-10-01
https://www.keycloak.org/2026/10/keycloak-2680-released
Red Hat Security Advisory RHSA-2026:95761 vom 2026-11-06
https://access.redhat.com/errata/RHSA-2026:95761
Red Hat Security Advisory RHSA-2026:95762 vom 2026-11-06
https://access.redhat.com/errata/RHSA-2026:95762