GHSA-4q93-v92x-p89f
Keycloak Vulnerable to Incorrect Authorization
At a glance
- Published
- Updated
- CVE
- CVE-2026-9791
- CVSS_V3
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Description
A flaw was found in Keycloak. An authenticated user with existing organization membership can exploit this flaw by accessing user-facing APIs, such as the account API or by requesting an OpenID Connect (OIDC) token with the 'organization' scope. This allows organization metadata to be disclosed in tokens, even after an administrator has explicitly disabled the Organizations feature, potentially leading to incorrect authorization decisions by resource servers.
Affected packages
| Package | Versions |
|---|---|
| Maven · org.keycloak:keycloak-server-spi-private | introduced 26.5.0, fixed 26.6.3 |
| Maven · org.keycloak:keycloak-services | introduced 26.5.0, fixed 26.6.3 |
| Maven · org.keycloak:keycloak-server-spi-private | introduced 0, last affected 26.4.7 |
| Maven · org.keycloak:keycloak-services | introduced 0, last affected 26.4.7 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2026-9791 ADVISORY
- https://github.com/keycloak/keycloak/issues/49431 WEB
- https://github.com/keycloak/keycloak/pull/49541 WEB
- https://github.com/keycloak/keycloak/pull/49678 WEB
- https://github.com/keycloak/keycloak/pull/49680 WEB
- https://github.com/keycloak/keycloak/commit/0e706e7c83d1e971b48656ad9e674eec6adc225b WEB
- https://github.com/keycloak/keycloak/commit/a77c60f2f3e0793046add44120579871e92553df WEB
- https://github.com/keycloak/keycloak/commit/f19e1f2b4e998116d4e321f50ecf99c0f87b862f WEB
- https://access.redhat.com/errata/RHSA-2026:25097 WEB
- https://access.redhat.com/errata/RHSA-2026:25098 WEB
- https://access.redhat.com/errata/RHSA-2026:30049 WEB
- https://access.redhat.com/errata/RHSA-2026:30050 WEB
- https://access.redhat.com/security/cve/CVE-2026-9791 WEB
- https://bugzilla.redhat.com/show_bug.cgi?id=2482458 WEB
- https://github.com/keycloak/keycloak PACKAGE
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |