Skip to main content

Keycloak CVE-2026-97177

| EUVDEUVD-2026-85793 MEDIUM
Missing Authorization (CWE-862)
2026-09-24 redhat GHSA-pgx8-hgcr-q6rq
Authentication Bypass Red Hat Keycloak Red Hat Build Of Keycloak Red Hat Single Sign On 7 Red Hat
6.6
CVSS 3.1 · Vendor: redhat
Share

Severity by source

Vendor (redhat) PRIMARY
6.6 MEDIUM
AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
6.6 MEDIUM

Attacker needs an authenticated delegated-admin account (PR:H) and FGAP must be enabled, a non-default state (AC:H); account takeover yields full C:H/I:H/A:H within the same realm authority (S:U).

3.1 AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
4.0 AV:N/AC:H/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Red Hat
6.6 MEDIUM
qualitative

Primary rating from Vendor (redhat).

CVSS VectorVendor: redhat

Attack Vector
Network
Attack Complexity
High
Privileges Required
High
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

3
Metadata Corrected
Sep 24, 2026 - 06:40 vuln.today
tag: Keycloak added
Analysis Generated
Sep 24, 2026 - 06:16 vuln.today
CVE Published
Sep 24, 2026 - 05:47 cve.org
MEDIUM 6.6

DescriptionCVE.org

A flaw was found in the user update mechanism of the Keycloak Admin REST API. When Fine-Grained Admin Permissions are enabled, the system fails to check for specific password reset authorizations during a general user profile update. This allows a delegated administrator, who should be restricted from resetting passwords, to change a user's credentials and take over their account.

AnalysisAI

Authenticated delegated administrators in Keycloak can reset other users' passwords and take over their accounts when Fine-Grained Admin Permissions (FGAP) are enabled, because the Admin REST API's general user-update path skips the password-reset authorization check that the dedicated credential-reset flow enforces. Red Hat Build of Keycloak and Red Hat Single Sign-On 7 are the affected downstream products, and the flaw is rated 6.6 (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H, CWE-862). …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
technique details hidden
Delivery
technique details hidden
Exploit
technique details hidden
Execution
technique details hidden
Persist
technique details hidden
Impact
technique details hidden
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Requires Fine-Grained Admin Permissions (FGAP) to be explicitly enabled in the Keycloak/Red Hat SSO realm, plus the attacker holding an authenticated delegated administrator account that has user-profile edit rights but is specifically restricted from password-reset (PR:H). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment This is a genuine but conditionally-gated privilege-escalation flaw, not an internet-facing pre-auth crisis. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation No vendor-released patch was identified at time of analysis; monitor the Red Hat CVE page at https://access.redhat.com/security/cve/CVE-2026-97177 and Bugzilla issue 2539965 (https://bugzilla.redhat.com/show_bug.cgi?id=2539965) for the fixed Keycloak / Red Hat Build of Keycloak / RH-SSO 7 build and apply it as soon as it is published. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Keycloak

View all
CVE-2023-48795 MEDIUM POC
5.9 Dec 18

The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remot
CVE-2014-3709 HIGH POC
8.8 Oct 18

The org.keycloak.services.resources.SocialResource.callback method in JBoss KeyCloak before 1.0.3.Final allows remote at
CVE-2023-6563 HIGH POC
7.7 Dec 14

An unconstrained memory consumption vulnerability was discovered in Keycloak. Rated high severity (CVSS 7.7), this vulne
CVE-2022-1466 MEDIUM POC
6.5 Apr 26

Due to improper authorization, Red Hat Single Sign-On is vulnerable to users performing actions that they should not be

CVE-2017-7474 CRITICAL
9.8 May 12

It was found that the Keycloak Node.js adapter 2.5 - 3.0 did not handle invalid tokens correctly. Rated critical severit
CVE-2026-76187 CRITICAL
9.8 Sep 15

Authentication bypass in the Apache Airflow Keycloak auth manager provider (apache-airflow-providers-keycloak below 0.10
CVE-2022-1245 CRITICAL
9.8 Jul 08

A privilege escalation flaw was found in the token exchange feature of keycloak. Rated critical severity (CVSS 9.8), thi
CVE-2019-14910 CRITICAL
9.8 Dec 05

A vulnerability was found in keycloak 7.x, when keycloak is configured with LDAP user federation and StartTLS is used in
CVE-2021-20195 CRITICAL
9.6 May 28

A flaw was found in keycloak in versions before 13.0.0. Rated critical severity (CVSS 9.6), this vulnerability is remote
CVE-2023-6134 MEDIUM POC
5.4 Dec 14

A flaw was found in Keycloak that prevents certain schemes in redirects, but permits them if a wildcard is appended to t
CVE-2022-0225 MEDIUM POC
5.4 Aug 26

A flaw was found in Keycloak. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack c
CVE-2020-10770 MEDIUM POC
5.3 Dec 15

A flaw was found in Keycloak before 13.0.0, where it is possible to force the server to call out an unverified URL using

Same weakness CWE-862 – Missing Authorization

View all
CVE-2023-52163 HIGH POC
8.8
CVE-2025-6205 CRITICAL POC
9.1
CVE-2025-20362 HIGH POC
8.6
CVE-2017-9232 CRITICAL POC
9.8
CVE-2023-6875 CRITICAL POC
9.8
CVE-2024-4898 CRITICAL POC
9.8
CVE-2023-32117 CRITICAL POC
9.8
CVE-2020-36719 CRITICAL POC
9.8

Same technique Authentication Bypass

View all
CVE-2015-3306 CRITICAL POC
10.0
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3

Vendor StatusVendor

Share

CVE-2026-97177 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy