GHSA-6q37-7866-h27jLowCVSS 2.7

Keycloak Admin REST (Representational State Transfer) API does not properly enforce permissions

Published
December 10, 2025
Last Modified
April 2, 2026

🔗 CVE IDs covered (1)

CVE-2025-14082 →

📋 Description

A flaw was found in Keycloak Admin REST (Representational State Transfer) API. This vulnerability allows information disclosure of sensitive role metadata via insufficient authorization checks on the /admin/realms/{realm}/roles endpoint.

🎯 Affected products1

  • maven/org.keycloak:keycloak-services:< 26.5.0

🔗 References (7)