17 matches found
keycloak-services: keycloak-services: Group hierarchy search discloses hidden parent groups under FGAP v2
A flaw was found in the group search functionality of the Keycloak server's administrative API. When Fine-Grained Admin Permissions FGAP v2 is enabled, a delegated administrator can bypass access restrictions to view parent groups they are not authorized to see. By searching for a child group the...
keycloak-services: keycloak-services: FGAP V2 group assignment bypass during user creation
A flaw was found in the user creation component of Keycloak when Fine-Grained Admin Permissions V2 FGAP V2 is enabled. This issue allows a sub-administrator with permission to create users to add those users to any group, even groups the sub-administrator is not authorized to manage. This could...
keycloak-services: keycloak-services: Realm default-group reads disclose hidden groups under FGAP v2
A flaw was found in the default-groups REST endpoint and realm representation of Keycloak. This component is responsible for managing groups that are automatically assigned to new users within a realm. The issue allows a delegated administrator with realm-viewing permissions to see the names and...
Important: Red Hat Security Advisory: Red Hat build of Keycloak 26.6.7 Security Update
New Red Hat build of Keycloak 26.6.7 packages are available from the Customer Portal Red Hat build of Keycloak 26.6.7 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single sign-on capabilities for web and mobile applications. Security fixes...
BIT-KEYCLOAK-2026-18571 Keycloak-services: keycloak-services: fgap v2 group assignment bypass during user creation
A flaw was found in the user creation component of Keycloak when Fine-Grained Admin Permissions V2 FGAP V2 is enabled. This issue allows a sub-administrator with permission to create users to add those users to any group, even groups the sub-administrator is not authorized to manage. This could...
Vulnerabilities hidden within Keycloak
Red Hat has addressed several vulnerabilities in Keycloak. The vulnerability with CVE-2026-18963 allows an unauthorized external attacker to force a password reset for any user account, thereby enabling them to take control of that account. This vulnerability exposes the email verification proces...
BIT-KEYCLOAK-2026-15945 Keycloak-services: keycloak-services: group hierarchy search discloses hidden parent groups under fgap v2
A flaw was found in the group search functionality of the Keycloak server's administrative API. When Fine-Grained Admin Permissions FGAP v2 is enabled, a delegated administrator can bypass access restrictions to view parent groups they are not authorized to see. By searching for a child group the...
BIT-KEYCLOAK-2026-14613 Keycloak-services: keycloak-services: keycloak: fgap v2 role groups endpoint discloses hidden group metadata without group view permission
A vulnerability was discovered in Keycloak's administrative interface that allows certain administrators to see information about groups they shouldn't have access to. When the new Fine-Grained Admin Permissions FGAP v2 are turned on, an administrator who is allowed to see a specific "role" can...
BIT-KEYCLOAK-2026-14615 Keycloak-services: keycloak: fgap v2 parent group children endpoint bypasses per-child view permission filter
A flaw was found in the Fine-Grained Admin Permissions FGAP v2 implementation within Keycloak's administrative services. When FGAP v2 is enabled, the system fails to properly filter child groups based on the caller's specific permissions when requested through a parent group. This allows a...
BIT-KEYCLOAK-2026-14614 Keycloak-services: keycloak-services: fgap v2 client scope assignment bypass via clientresource
A flaw was found in the ClientResource component of Keycloak's admin services when Fine-Grained Admin Permissions FGAP v2 is enabled. This issue allows a delegated administrator, who should only have limited control over specific clients, to attach or remove hidden client scopes that they are not...
Keycloak 26.6.x < 26.6.6 Multiple Vulnerabilities
The version of Keycloak installed on the remote host is 26.6.x prior to 26.6.6. It is, therefore, affected by multiple vulnerabilities: - A flaw was found in the legacy client-initiated account-linking endpoint of Keycloak. The mechanism used to protect the account-linking process from unauthoriz...
keycloak-services: keycloak-services: Keycloak: FGAP v2 role groups endpoint discloses hidden group metadata without group view permission
A vulnerability was discovered in Keycloak's administrative interface that allows certain administrators to see information about groups they shouldn't have access to. When the new Fine-Grained Admin Permissions FGAP v2 are turned on, an administrator who is allowed to see a specific "role" can...
Keycloak -- multiple vulnerabilities
The Keycloak Team reports: CVE-2026-9793: JWE request object bypasses requestObjectSignatureAlg enforcement CVE-2026-4629: Privilege escalation via hardcoded role mapper injection in manage-clients CVE-2026-14209: Keycloak Admin UI Extension brute-force-user User Disclosure via search=id: under...
Missing Authorization
Overview org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services. Affected versions of this package are vulnerable to Missing Authorization through the user creation path in UsersResource.create and...
Information Exposure
Overview org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services. Affected versions of this package are vulnerable to Information Exposure due to insufficient group-permission filtering in RealmAdminResource.getRealm,...
Insufficient Granularity of Access Control
Overview org.keycloak:keycloak-server-spi-private is an open source identity and access management solution for modern applications and services. Affected versions of this package are vulnerable to Insufficient Granularity of Access Control in the group retrieval due to an improper conditional...
