GitHub Advisoryadvisory · Maven

GHSA-gvgg-2r3r-53x7 Improper Authorization in Keycloak Organization Mapper Allows Unauthorized Organization Claims

MEDIUM Published 2025-03-10 Modified 2025-03-10 Official page ↗
Aliases
CVE-2025-1391
Ecosystem
Maven
Packages
org.keycloak:keycloak-services
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Weaknesses
CWE-284
Reviewed
2025-03-10

Affected packages

• Maven org.keycloak:keycloak-services: >= 26.1.0, < 26.1.3 → fixed in 26.1.3 • Maven org.keycloak:keycloak-services: < 26.0.10 → fixed in 26.0.10

Description

This vulnerability is caused by the improper mapping of users to organizations based solely on email/username patterns. The issue is limited to the token claim level, meaning the user is not truly added to the organization but may appear as such in applications relying on these claims. The risk increases in scenarios where self-registration is enabled and unrestricted, allowing an attacker to exploit the naming pattern. The issue is mitigated if admins restrict registration or use strict validation mechanisms.

Related

Alias · CVE (1)

  • CVE-2025-1391 A flaw was found in the Keycloak organization feature, which allows the incorrect assignment of an organization to a user if their username… vulnerability

Weakness · CWE (1)

  • CWE-284 Improper Access Control weakness

References