Description
A flaw was found in Keycloak. An authenticated user with existing organization membership can exploit this flaw by accessing user-facing APIs, such as the account API or by requesting an OpenID Connect (OIDC) token with the 'organization' scope. This allows organization metadata to be disclosed in tokens, even after an administrator has explicitly disabled the Organizations feature, potentially leading to incorrect authorization decisions by resource servers.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Red Hat | Red Hat build of Keycloak 26.4 | — | — |
| Red Hat | Red Hat build of Keycloak 26.4.13 | — | — |
| Red Hat | Red Hat build of Keycloak 26.6 | — | — |
| Red Hat | Red Hat build of Keycloak 26.6.3 | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | keycloak-26.5 +2 | No fix yet | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.keycloak:keycloak-server-spi-private | >= 26.5.0, < 26.6.3 | 26.6.3 | GHSA-4q93-v92x-p89f |
| Maven | org.keycloak:keycloak-server-spi-private | <= 26.4.7 | — | GHSA-4q93-v92x-p89f |
| Maven | org.keycloak:keycloak-services | >= 26.5.0, < 26.6.3 | 26.6.3 | GHSA-4q93-v92x-p89f |
| Maven | org.keycloak:keycloak-services | <= 26.4.7 | — | GHSA-4q93-v92x-p89f |
Advisories 1
- WID-SEC-2026-1708 Keycloak: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 8, 2026
References
- RHSA-2026:25097 vendor-advisory
- RHSA-2026:25098 vendor-advisory
- RHSA-2026:30049 vendor-advisory
- RHSA-2026:30050 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2026-9791 vdb-entry
- RHBZ#2482458 issue-tracking