GHSA-594w-2fwp-jwrc
Keycloak Admin REST API exposes backend schema and rules
At a glance
- Published
- Updated
- CVE
- CVE-2025-14083
- CVSS_V3
- CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
Description
A flaw was found in the Keycloak Admin REST API. This vulnerability allows the exposure of backend schema and rules, potentially leading to targeted attacks or privilege escalation via improper access control.
Affected packages
| Package | Versions |
|---|---|
| Maven · org.keycloak:keycloak-services | introduced 0, last affected 26.2.5 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2025-14083 ADVISORY
- https://github.com/keycloak/keycloak/issues/45493 WEB
- https://access.redhat.com/errata/RHSA-2026:6477 WEB
- https://access.redhat.com/errata/RHSA-2026:6478 WEB
- https://access.redhat.com/security/cve/CVE-2025-14083 WEB
- https://bugzilla.redhat.com/show_bug.cgi?id=2419086 WEB
- https://github.com/keycloak/keycloak PACKAGE
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |