~ / search / GHSA-hm32-hfmw-rhvg

GHSA-hm32-hfmw-rhvg

Keycloak has a Forced Browsing issue

Source: GitHub Advisory Database (reviewed) Moderate CVE-2026-7500

Packages

EcosystemPackageAffectedFixed in
Maven org.keycloak:keycloak-services <= 26.6.1 no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

When Keycloak is started with `--features-disabled=account,account-api`, the Account REST API is only partially disabled. Five endpoints under the versioned path `/account/v1alpha1` remain fully functional — including both read and write operations — because they lack the `checkAccountApiEnabled()` gate that correctly blocks four other endpoints in the same REST service class. The user needs to have permissions to use the API.

References

External links from the advisory. They lead to third-party sites.