EUVD-2026-45223
GHSA-mvwh-6438-3v8w
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Network-accessible admin API; requires low-privilege delegated admin auth; only group names/IDs disclosed with no integrity or availability impact.
Primary rating from Vendor (redhat).
CVSS VectorNVD
Lifecycle Timeline
3DescriptionNVD
A flaw was found in the default-groups REST endpoint and realm representation of Keycloak. This component is responsible for managing groups that are automatically assigned to new users within a realm. The issue allows a delegated administrator with realm-viewing permissions to see the names and identifiers of hidden default groups, even if they lack the specific permissions to view those groups. This can lead to the exposure of sensitive organizational structures or internal group names.
AnalysisAI
Keycloak's default-groups REST endpoint and realm representation expose hidden group names and identifiers to delegated administrators who hold realm-viewing permissions but lack explicit group-viewing authorization. Affected products span Red Hat Build of Keycloak, Red Hat Single Sign-On 7, Red Hat Data Grid 8, and Red Hat JBoss EAP Expansion Pack. No public exploit code exists and CISA KEV listing is absent at time of analysis; the CVSS 4.3 Medium rating accurately reflects constrained impact limited to metadata disclosure.
Technical ContextAI
Keycloak is Red Hat's enterprise identity and access management platform, providing authentication, authorization, and single sign-on services. The vulnerable component is the admin REST API's default-groups endpoint and the realm representation object, which governs which groups are automatically assigned to newly registered users within a realm. The flaw is an authorization enforcement gap: the API returns group names and internal identifiers for groups designated as hidden without verifying that the requesting principal holds group-view permissions - only realm-view permissions are checked. This is consistent with CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) or CWE-285 (Improper Authorization), though no formal CWE is assigned. CPE data confirms the flaw is present across cpe:2.3:a:red_hat:red_hat_build_of_keycloak, cpe:2.3:a:red_hat:red_hat_single_sign-on_7, cpe:2.3:a:red_hat:red_hat_data_grid_8, and cpe:2.3:a:red_hat:red_hat_jboss_enterprise_application_platform_expansion_pack.
RemediationAI
Apply the vendor-supplied patch per the Red Hat security advisory at https://access.redhat.com/security/cve/CVE-2026-16108; specific patched version numbers are not confirmed in the available input data and must be verified there. As an immediate compensating control, audit and restrict delegated administrator role assignments: revoke realm-view permissions from any account that does not legitimately require visibility into realm structure, adhering to least-privilege principles - this eliminates the attack surface without requiring a patch, though it may limit administrative workflows. Additionally, if hidden group names encode sensitive organizational data, consider renaming groups to opaque identifiers until the patch is applied; this reduces the value of any disclosed information but introduces operational overhead for administrators who rely on descriptive names. Track remediation progress via Bugzilla entry https://bugzilla.redhat.com/show_bug.cgi?id=2501740.
More in Red Hat Build Of Keycloak
View allAccount takeover in Red Hat Build of Keycloak allows an unauthenticated attacker to abuse the reset-credentials flow in
Account takeover in Keycloak (Red Hat build of Keycloak, Red Hat Single Sign-On 7) arises because the IdP-initiated SAML
Authentication bypass in Red Hat Build of Keycloak (and Red Hat Single Sign-On 7) lets an unauthenticated attacker forge
Privilege escalation in Red Hat Build of Keycloak's Dynamic Client Registration (DCR) grants an attacker with low-privil
Authorization bypass in the Keycloak Policy Enforcer allows any authenticated user to circumvent all enforced access con
URI normalization bypass in Keycloak's Authorization Services PathMatcher allows authenticated low-privilege users to re
Privilege escalation in Keycloak's Dynamic Client Registration (DCR) component allows attackers with standard user accou
Token exchange in Keycloak bypasses Google Workspace domain allowlist restrictions, enabling any valid Google account ho
Signature-verification bypass in Keycloak (and Red Hat's Keycloak-based products such as Red Hat Single Sign-On 7 and Re
Tenant-restriction bypass in Keycloak's Microsoft identity provider integration allows attackers holding any valid Micro
Session hijacking via SAML assertion replay in Keycloak's SAML broker component allows adjacent-network attackers to aut
Open redirect in Red Hat build of Keycloak permits remote attackers to send victims to attacker-controlled hosts by abus
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today