EUVD-2026-26381Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Lifecycle Timeline
4Blast Radius
ecosystem impact- 76 maven packages depend on org.keycloak:keycloak-services (42 direct, 34 indirect)
Ecosystem-wide dependent count for version 26.6.1.
DescriptionCVE.org
When Keycloak is started with --features-disabled=account,account-api, the Account REST API is only partially disabled. Five endpoints under the versioned path /account/v1alpha1 remain fully functional - including both read and write operations - because they lack the checkAccountApiEnabled() gate that correctly blocks four other endpoints in the same REST service class. The user needs to have permissions to use the API.
AnalysisAI
Keycloak's Account REST API remains partially accessible even when explicitly disabled via the --features-disabled=account,account-api flag, allowing authenticated users to read and modify account data through five unprotected endpoints under /account/v1alpha1/ that lack the required checkAccountApiEnabled() access control gate present in four sibling endpoints within the same service class.
Technical ContextAI
Keycloak's Account REST API is designed to be disabled entirely via the --features-disabled feature flag mechanism, which gates API endpoints through a checkAccountApiEnabled() validation function. However, five endpoints under the versioned path /account/v1alpha1/ were not instrumented with this guard, representing an incomplete implementation of the feature disable logic. This is a control-flow bypass in the authorization layer (CWE-425: Direct Request ('Fire-and-Forget') Execution) where certain API routes escape the intended access control checks that protect the feature flag. The vulnerability affects Red Hat Build of Keycloak across all versions prior to the patch, as indicated by the CPE wildcard matching any version.
RemediationAI
Upgrade Keycloak to the patched version released by Red Hat for CVE-2026-7500, available via https://access.redhat.com/security/cve/CVE-2026-7500. The patch instruments all five vulnerable endpoints with the missing checkAccountApiEnabled() access control gate to ensure the feature flag is consistently enforced across the entire Account REST API surface. Until patching is possible, implement network-level access controls to restrict access to the /account/v1alpha1/ endpoints at the ingress or reverse proxy layer (e.g., deny traffic to paths matching /account/v1alpha1/*), though this workaround may break legitimate account management features if clients rely on versioned endpoints. Alternatively, disable Keycloak's Account REST API entirely at the application level by removing the account management feature from your deployment if it is not required, or segregate user access such that only trusted administrators can authenticate to Keycloak instances with account features disabled.
More in Red Hat Build Of Keycloak
View allAuthorization bypass in the Keycloak Policy Enforcer allows any authenticated user to circumvent all enforced access con
Signature-verification bypass in Keycloak (and Red Hat's Keycloak-based products such as Red Hat Single Sign-On 7 and Re
Open redirect in Red Hat build of Keycloak permits remote attackers to send victims to attacker-controlled hosts by abus
Identity linking bypass in Red Hat build of Keycloak allows an attacker controlling a second account on the same upstrea
Authenticated users with uma_protection role in Red Hat Keycloak can bypass User-Managed Access policy validation to gai
Privilege escalation in Keycloak (Red Hat Build of Keycloak) lets an authenticated delegated admin with management right
Denial of service in Red Hat build of Keycloak allows remote unauthenticated attackers to exhaust CPU and worker threads
Denial of Service in Red Hat Build of Keycloak allows unauthenticated remote attackers to exhaust server resources by su
Session fixation in Keycloak's login-actions endpoints allows remote attackers to hijack authenticated sessions and take
Authorization code forgery in Red Hat Keycloak enables unauthenticated attackers to escalate privileges to admin-level a
Stored Cross-Site Scripting in Red Hat Build of Keycloak lets an authenticated administrator with `manage-client` permis
Open redirect in Red Hat Build of Keycloak allows authenticated attackers with control over another path on the same web
Same weakness CWE-425 – Direct Request ('Forced Browsing')
View allSame technique Information Disclosure
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today