~ / search / GHSA-r8jr-wg88-fq5c

GHSA-r8jr-wg88-fq5c

Keycloak vulnerable to authorization bypass via the Admin API

Source: GitHub Advisory Database (reviewed) Low CVE-2026-2366

Packages

EcosystemPackageAffectedFixed in
npm @keycloak/keycloak-admin-client <= 26.5.5 no fix listed
Maven org.keycloak:keycloak-js-admin-client <= 26.5.5 no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

A flaw was found in Keycloak. An authorization bypass vulnerability in the Keycloak Admin API allows any authenticated user, even those without administrative privileges, to enumerate the organization memberships of other users. This information disclosure occurs if the attacker knows the victim's unique identifier (UUID) and the Organizations feature is enabled.

References

External links from the advisory. They lead to third-party sites.