Description
A flaw was found in the Keycloak Admin REST API. This vulnerability allows the exposure of backend schema and rules, potentially leading to targeted attacks or privilege escalation via improper access control.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Red Hat | Red Hat build of Keycloak 26.4 | — | — |
| Red Hat | Red Hat build of Keycloak 26.4.11 | — | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.keycloak:keycloak-services | <= 26.2.5 | — | GHSA-594w-2fwp-jwrc |
Advisories 1
- WID-SEC-2026-0197 Keycloak: Mehrere Schwachstellen BSI CERT-Bund (WID) · Apr 6, 2026
References
- RHSA-2026:6477 vendor-advisory
- RHSA-2026:6478 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2025-14083 vdb-entry
- RHBZ#2419086 issue-tracking