GitHub Advisoryadvisory · Maven
GHSA-c739-f6xw-6pv2 Keycloak Protection API allows authenticated clients to access and modify resources owned by other Resource Servers
MEDIUM
Official page ↗
- Aliases
- CVE-2026-4630
- Ecosystem
- Maven
- Packages
- org.keycloak:keycloak-services
- Severity
- Moderate
- CVSS vector
- CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
- Weaknesses
- CWE-639
- Reviewed
- 2026-06-30
Affected packages
• Maven org.keycloak:keycloak-services: < 26.6.2 → fixed in 26.6.2
Description
Keycloak's Authorization Services feature exposes a User-Managed Access Protection API that include an Insecure Direct Object Reference (IDOR) vulnerability in the Authorization Services Protection API endpoint. By knowing or obtaining a resource's unique identifier (UUID) belonging to another Resource Server within the same realm, an authenticated client could bypass authorization checks. This allows the client to perform unauthorized GET, PUT, and DELETE operations on resources, leading to information disclosure and potential unauthorized modification or deletion of data.
Related
Alias · CVE (1)
- CVE-2026-4630 A flaw was found in Keycloak. vulnerability
Weakness · CWE (1)
- CWE-639 Authorization Bypass Through User-Controlled Key weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2026-4630 advisory
- https://github.com/keycloak/keycloak/issues/49115 web
- https://github.com/keycloak/keycloak/pull/49121 web
- https://github.com/keycloak/keycloak/commit/0cea089bd19f5061f5fd47099fd6fb41a17d8c55 web
- https://github.com/keycloak/keycloak/commit/1192267af8f16a7b722bdc2abbd3410c477388aa web
- https://github.com/keycloak/keycloak/commit/4e9b17cbedb828b4afc6b62399eee317d4735234 web
- https://access.redhat.com/errata/RHSA-2026:19596 web
- https://access.redhat.com/errata/RHSA-2026:19597 web
- https://access.redhat.com/security/cve/CVE-2026-4630 web
- https://bugzilla.redhat.com/show_bug.cgi?id=2450245 web
- https://github.com/keycloak/keycloak package