Skip to content
OpenAdvisories
Medium · 6.5 CVE-2026-4629 EUVD-2026-40300GHSA-m4j4-8chj-8g5f

Keycloak: keycloak: privilege escalation through hardcoded role mapper injection

Published Jun 30, 2026 · Updated Oct 22, 2026 · Assigned by redhat

Description

A flaw was found in Keycloak. A highly privileged user with `manage-clients` permission can exploit this vulnerability by injecting a hardcoded role mapper into any client. This action allows the user to bypass existing scope restrictions and inject the `realm-admin` role into generated tokens, resulting in privilege escalation and full administrative access to the realm.

Affected products

VendorProductAffectedFixed
Red Hat Red Hat build of Keycloak 26.4 — —
Red Hat Red Hat build of Keycloak 26.4.14 — —
Red Hat Red Hat build of Keycloak 26.6.5 — —

Advisories 1

References