Skip to main content

Red Hat Keycloak CVE-2026-7500

| EUVD-2026-26381 MEDIUM
Direct Request ('Forced Browsing') (CWE-425)
2026-04-30 redhat
Information Disclosure Red Hat
5.4
CVSS 3.1
Share

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
None

Lifecycle Timeline

4
Analysis Generated
Apr 30, 2026 - 15:30 vuln.today
EUVD ID Assigned
Apr 30, 2026 - 15:00 euvd
EUVD-2026-26381
Analysis Generated
Apr 30, 2026 - 15:00 vuln.today
CVE Published
Apr 30, 2026 - 14:53 nvd
MEDIUM 5.4

Blast Radius

ecosystem impact
† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth
  • 75 maven packages depend on org.keycloak:keycloak-services (41 direct, 34 indirect)

Ecosystem-wide dependent count for version 26.6.1.

DescriptionNVD

When Keycloak is started with --features-disabled=account,account-api, the Account REST API is only partially disabled. Five endpoints under the versioned path /account/v1alpha1 remain fully functional - including both read and write operations - because they lack the checkAccountApiEnabled() gate that correctly blocks four other endpoints in the same REST service class. The user needs to have permissions to use the API.

AnalysisAI

Keycloak's Account REST API remains partially accessible even when explicitly disabled via the --features-disabled=account,account-api flag, allowing authenticated users to read and modify account data through five unprotected endpoints under /account/v1alpha1/ that lack the required checkAccountApiEnabled() access control gate present in four sibling endpoints within the same service class.

Sign in for full analysis, threat intelligence, and remediation guidance.

Full analysis requires sign-in

Get intelligence summaries, risk assessment, exploit details, threat intel, and remediation guidance.

Sign in - Free

More from same product – last 7 days

CVE-2026-9277 HIGH
8.1 May 22

Command injection in the shell-quote npm package allows attackers who can influence object-token inputs to inject arbitr
CVE-2026-9256 HIGH
8.1 May 22

Heap buffer overflow in NGINX Plus and NGINX Open Source ngx_http_rewrite_module allows unauthenticated remote attackers

Vendor StatusVendor

Share

CVE-2026-7500 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy