GitHub Advisoryadvisory · Maven

GHSA-4q93-v92x-p89f Keycloak Vulnerable to Incorrect Authorization

MEDIUM Published 2026-05-28 Modified 2026-07-01 Official page ↗
Aliases
CVE-2026-9791
Ecosystem
Maven
Packages
org.keycloak:keycloak-server-spi-private, org.keycloak:keycloak-services
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-863
Reviewed
2026-07-01

Affected packages

• Maven org.keycloak:keycloak-server-spi-private: >= 26.5.0, < 26.6.3 → fixed in 26.6.3 • Maven org.keycloak:keycloak-services: >= 26.5.0, < 26.6.3 → fixed in 26.6.3 • Maven org.keycloak:keycloak-server-spi-private: <= 26.4.7 (no fix yet) • Maven org.keycloak:keycloak-services: <= 26.4.7 (no fix yet)

Description

A flaw was found in Keycloak. An authenticated user with existing organization membership can exploit this flaw by accessing user-facing APIs, such as the account API or by requesting an OpenID Connect (OIDC) token with the 'organization' scope. This allows organization metadata to be disclosed in tokens, even after an administrator has explicitly disabled the Organizations feature, potentially leading to incorrect authorization decisions by resource servers.

Related

Alias · CVE (1)

Weakness · CWE (1)

  • CWE-863 Incorrect Authorization weakness

References