EUVD-2026-40301
GHSA-jxqv-2jjx-692h
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
PR:H reflects mandatory IdP admin role; AV:N for web console access; no availability impact from role assignment alone.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
Lifecycle Timeline
1DescriptionCVE.org
A flaw was found in the Identity Provider (IdP) mapper component of Keycloak, which is used to manage how user information from external services is mapped to Keycloak users. An administrator with limited permissions to manage identity providers can exploit this flaw by creating a "Hardcoded Role" mapper that assigns high-level administrative roles (like realm-admin) to themselves or others. This allows a restricted administrator to bypass security checks and gain full control over the entire realm.
AnalysisAI
Privilege escalation in Red Hat Build of Keycloak's Identity Provider mapper component allows a restricted administrator with IdP management permissions to silently assign the built-in realm-admin role to themselves or other accounts by creating a Hardcoded Role mapper. This bypasses the authorization boundary intended to confine limited administrators within their delegated scope, resulting in full realm takeover. No public exploit code or CISA KEV listing exists at time of analysis; however, the impact is severe in multi-tenant or delegated-administration deployments where IdP management is granted to semi-trusted parties.
Technical ContextAI
Keycloak's Identity Provider subsystem supports attribute mappers - plugins that transform user data received from external IdPs into Keycloak's internal user model. The 'Hardcoded Role' mapper type statically assigns a specified Keycloak role to any user authenticating via the associated IdP, regardless of claims in the identity token. The root cause is CWE-266 (Incorrect Privilege Assignment): the authorization logic governing mapper creation fails to enforce that the assigning administrator can only grant roles up to their own privilege ceiling. Consequently, an account holding only the identity-provider-management role can specify the privileged realm-admin compound role as the hardcoded target, circumventing the intended privilege separation. The affected product per CPE is cpe:2.3:a:red_hat:red_hat_build_of_keycloak:*:*:*:*:*:*:*:*, covering all version lines of the Red Hat distribution.
RemediationAI
The primary fix should be obtained from the Red Hat security advisory at https://access.redhat.com/security/cve/CVE-2026-12388; no specific patched version number is confirmed in the available intelligence, so consult that advisory for the exact target release. As an immediate compensating control, audit all existing Hardcoded Role mappers across every configured identity provider in each realm and remove or reconfigure any mapper that assigns realm-admin or other high-privilege compound roles - this eliminates any pre-staged escalation paths. Revoke identity provider management permissions from any administrator account that does not have a verified business need for that specific delegated role, tightening the privilege assignment model. Restrict the Keycloak admin console to a dedicated management network segment or VPN to reduce network-level exposure (trade-off: increases operational friction for distributed admin teams). Monitor Keycloak audit logs for unexpected role assignment events, particularly additions of realm-admin to accounts that did not previously hold it.
More in Red Hat Build Of Keycloak
View allAccount takeover in Red Hat Build of Keycloak allows an unauthenticated attacker to abuse the reset-credentials flow in
Account takeover in Keycloak (Red Hat build of Keycloak, Red Hat Single Sign-On 7) arises because the IdP-initiated SAML
Authentication bypass in Red Hat Build of Keycloak (and Red Hat Single Sign-On 7) lets an unauthenticated attacker forge
Privilege escalation in Red Hat Build of Keycloak's Dynamic Client Registration (DCR) grants an attacker with low-privil
Authorization bypass in the Keycloak Policy Enforcer allows any authenticated user to circumvent all enforced access con
URI normalization bypass in Keycloak's Authorization Services PathMatcher allows authenticated low-privilege users to re
Privilege escalation in Keycloak's Dynamic Client Registration (DCR) component allows attackers with standard user accou
Token exchange in Keycloak bypasses Google Workspace domain allowlist restrictions, enabling any valid Google account ho
Signature-verification bypass in Keycloak (and Red Hat's Keycloak-based products such as Red Hat Single Sign-On 7 and Re
Tenant-restriction bypass in Keycloak's Microsoft identity provider integration allows attackers holding any valid Micro
Session hijacking via SAML assertion replay in Keycloak's SAML broker component allows adjacent-network attackers to aut
Open redirect in Red Hat build of Keycloak permits remote attackers to send victims to attacker-controlled hosts by abus
Same weakness CWE-266 – Incorrect Privilege Assignment
View allSame technique Authentication Bypass
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today