Keycloak Admin REST (Representational State Transfer) API does not properly enforce permissions

Description

References

• nvd.nist.gov/vuln/detail/CVE-2025-14082 · ADVISORY
• keycloak/keycloak commit 89a8cdd · WEB
• access.redhat.com/errata/RHSA-2026:6477 · WEB
• access.redhat.com/errata/RHSA-2026:6478 · WEB
• access.redhat.com/security/cve/CVE-2025-14082 · WEB
• bugzilla.redhat.com/show_bug.cgi · WEB
• keycloak/keycloak · PACKAGE

Autres vulnérabilités de org.keycloak:keycloak-services

• CVE-2026-18963CRITIQUE 9.1A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access manageme…
• CVE-2026-11800ÉLEVÉE 8.1A flaw was found in Keycloak. This JWT algorithm confusion vulnerability in the JWT Authorization Grant flow allows an attacker with valid c…
• CVE-2026-9800ÉLEVÉE 8.1A flaw was found in Keycloak Policy Enforcer. This vulnerability allows any authenticated user to bypass all authorization policies, includi…
• CVE-2026-9799MOYENNE 4.6A flaw was found in org.keycloak.authorization. An authenticated user with a granted User-Managed Access (UMA) permission ticket for one res…
• CVE-2026-9705MOYENNE 6.5A flaw was found in Keycloak's client registration service. A remote attacker, possessing a previously issued Registration Access Token (RAT…