EUVD-2026-40299
GHSA-xmfr-m52w-m2hx
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Network-reachable Admin REST API requires authenticated low-privilege admin; confidentiality limited to user profile data; no integrity or availability impact.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
Lifecycle Timeline
1DescriptionCVE.org
A vulnerability was discovered in Keycloak's Admin UI extension that allows certain administrative users to bypass security restrictions. When Fine-Grained Admin Permissions (FGAPv2) are enabled, an administrator who should only be able to search for users (but not view their full details) can use a specific "brute-force-user" endpoint to access a user's full profile. This includes sensitive information and security metadata. The issue occurs because the system fails to check if the administrator has the required "view" permission for that specific user when using this particular search path.
AnalysisAI
Unauthorized user profile disclosure in Red Hat Build of Keycloak allows low-privileged administrative users to bypass Fine-Grained Admin Permission (FGAPv2) restrictions and access complete user profiles they should only be permitted to search. An admin scoped exclusively to user-search rights can invoke the 'brute-force-user' endpoint to retrieve sensitive profile data and security metadata, circumventing the intended view-permission gate on that code path. No public exploit has been identified and the flaw is not listed in CISA KEV, but its network-accessible, low-complexity nature makes it straightforward to abuse within any Keycloak deployment that has activated FGAPv2 permission delegation.
Technical ContextAI
Keycloak is Red Hat's enterprise-grade Identity and Access Management (IAM) platform, distributed both as an upstream open-source project and as the Red Hat Build of Keycloak and as a component of the JBoss EAP Expansion Pack (CPE: cpe:2.3:a:red_hat:red_hat_build_of_keycloak and cpe:2.3:a:red_hat:red_hat_jboss_enterprise_application_platform_expansion_pack). Fine-Grained Admin Permissions v2 (FGAPv2) is an advanced authorization feature that allows Keycloak realm administrators to delegate scoped sub-administrator roles - for example, granting a helpdesk user the ability to search for accounts without permitting full profile reads. The vulnerability is rooted in CWE-639 (Authorization Bypass Through User-Controlled Key): the 'brute-force-user' Admin REST endpoint resolves the target user by a caller-supplied key (user identifier) but fails to evaluate whether the calling administrator holds the 'view' permission for that specific user resource. The search permission gate is checked correctly on other paths, but this particular endpoint bypasses that second-level authorization check, creating a missing-function-level access control flaw on a privileged API surface.
RemediationAI
Consult the Red Hat Security Advisory at https://access.redhat.com/security/cve/CVE-2026-14209 and the Bugzilla entry at https://bugzilla.redhat.com/show_bug.cgi?id=2494837 for the specific patched build version - no exact fixed release number is confirmed in the data available at time of analysis. As a compensating control pending patch application, administrators should audit all realms where FGAPv2 is enabled and review whether any delegated admin roles have been granted search-only permissions intended to be narrower than view access; if FGAPv2 delegation is not actively required, consider disabling it to eliminate the vulnerable code path entirely (trade-off: this removes all fine-grained delegation capabilities). Additionally, restrict network access to the Keycloak Admin REST API to trusted management networks only, reducing the attacker's ability to invoke the 'brute-force-user' endpoint remotely even if they hold valid credentials. Monitor Admin REST API logs for unexpected calls to brute-force-user endpoints from accounts not expected to perform that operation.
More in Red Hat Build Of Keycloak
View allAccount takeover in Red Hat Build of Keycloak allows an unauthenticated attacker to abuse the reset-credentials flow in
Account takeover in Keycloak (Red Hat build of Keycloak, Red Hat Single Sign-On 7) arises because the IdP-initiated SAML
Authentication bypass in Red Hat Build of Keycloak (and Red Hat Single Sign-On 7) lets an unauthenticated attacker forge
Privilege escalation in Red Hat Build of Keycloak's Dynamic Client Registration (DCR) grants an attacker with low-privil
Authorization bypass in the Keycloak Policy Enforcer allows any authenticated user to circumvent all enforced access con
URI normalization bypass in Keycloak's Authorization Services PathMatcher allows authenticated low-privilege users to re
Privilege escalation in Keycloak's Dynamic Client Registration (DCR) component allows attackers with standard user accou
Token exchange in Keycloak bypasses Google Workspace domain allowlist restrictions, enabling any valid Google account ho
Signature-verification bypass in Keycloak (and Red Hat's Keycloak-based products such as Red Hat Single Sign-On 7 and Re
Tenant-restriction bypass in Keycloak's Microsoft identity provider integration allows attackers holding any valid Micro
Session hijacking via SAML assertion replay in Keycloak's SAML broker component allows adjacent-network attackers to aut
Open redirect in Red Hat build of Keycloak permits remote attackers to send victims to attacker-controlled hosts by abus
Same technique Authentication Bypass
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today