GitHub Advisoryadvisory · Maven
GHSA-594w-2fwp-jwrc Keycloak Admin REST API exposes backend schema and rules
LOW
Official page ↗
- Aliases
- CVE-2025-14083
- Ecosystem
- Maven
- Packages
- org.keycloak:keycloak-services
- Severity
- Low
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
- Weaknesses
- CWE-284
- Reviewed
- 2026-01-21
Affected packages
• Maven org.keycloak:keycloak-services: <= 26.2.5 (no fix yet)
Description
A flaw was found in the Keycloak Admin REST API. This vulnerability allows the exposure of backend schema and rules, potentially leading to targeted attacks or privilege escalation via improper access control.
Related
Alias · CVE (1)
- CVE-2025-14083 A flaw was found in the Keycloak Admin REST API. vulnerability
Weakness · CWE (1)
- CWE-284 Improper Access Control weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2025-14083 advisory
- https://github.com/keycloak/keycloak/issues/45493 web
- https://access.redhat.com/errata/RHSA-2026:6477 web
- https://access.redhat.com/errata/RHSA-2026:6478 web
- https://access.redhat.com/security/cve/CVE-2025-14083 web
- https://bugzilla.redhat.com/show_bug.cgi?id=2419086 web
- https://github.com/keycloak/keycloak package