EUVD-2026-32701
GHSA-4q93-v92x-p89f
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Lifecycle Timeline
1Blast Radius
ecosystem impact- 60 maven packages depend on org.keycloak:keycloak-server-spi-private (29 direct, 31 indirect)
- 50 maven packages depend on org.keycloak:keycloak-services (22 direct, 28 indirect)
Ecosystem-wide dependent count for version 26.5.0 and other introduced versions.
DescriptionCVE.org
A flaw was found in Keycloak. An authenticated user with existing organization membership can exploit this flaw by accessing user-facing APIs, such as the account API or by requesting an OpenID Connect (OIDC) token with the 'organization' scope. This allows organization metadata to be disclosed in tokens, even after an administrator has explicitly disabled the Organizations feature, potentially leading to incorrect authorization decisions by resource servers.
AnalysisAI
Incorrect authorization enforcement in Red Hat Build of Keycloak allows an authenticated user with existing organization membership to retrieve organization metadata through the account API or via OIDC token requests using the 'organization' scope, even when an administrator has explicitly disabled the Organizations feature. The flaw (CWE-863) means the feature-disabled state is not enforced at the data-access layer, so tokens and API responses continue to carry organization claims. This can cause downstream resource servers that consume those tokens to make incorrect authorization decisions - for example, granting access based on organizational membership that should no longer be recognized. No public exploit code exists and this vulnerability is not listed in CISA KEV at time of analysis.
Technical ContextAI
Keycloak is Red Hat's enterprise-grade Identity and Access Management (IAM) platform, built on the upstream Keycloak project. Its Organizations feature allows grouping of users under organizational tenants with associated metadata embedded in OIDC tokens. The affected component is the token issuance and account API layer: when a user requests an OIDC token with the 'organization' scope or queries the account API, Keycloak should suppress organization claims if the Organizations feature has been administratively disabled. CWE-863 (Incorrect Authorization) describes the root cause - the authorization gate that checks feature-enablement status is not applied consistently across these user-facing endpoints, allowing residual org metadata to surface. The affected product per CPE is cpe:2.3:a:red_hat:red_hat_build_of_keycloak:*:*:*:*:*:*:*:*, with the wildcard version field indicating no version exclusion is recorded in NVD CPE data.
RemediationAI
No specific patched version number is confirmed in the available data - the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-9791 should be monitored for an official errata release containing the fix version. As a compensating control while awaiting the patch, administrators should audit OIDC client configurations to remove or restrict the 'organization' scope from clients used by potentially affected users, which prevents the scope from being requested and limits token enrichment with org metadata; the trade-off is that legitimate organization-aware clients will also lose this scope. Additionally, resource servers should not make authorization decisions solely on the 'organization' claim without cross-validating against a server-side authoritative source, which mitigates the downstream incorrect authorization risk independent of the Keycloak fix. Access to the account API endpoint for users with prior organizational membership can also be restricted at the network or gateway layer as a temporary measure, though this impacts legitimate self-service account management functionality.
More in Red Hat Build Of Keycloak
View allAuthorization bypass in the Keycloak Policy Enforcer allows any authenticated user to circumvent all enforced access con
Signature-verification bypass in Keycloak (and Red Hat's Keycloak-based products such as Red Hat Single Sign-On 7 and Re
Open redirect in Red Hat build of Keycloak permits remote attackers to send victims to attacker-controlled hosts by abus
Identity linking bypass in Red Hat build of Keycloak allows an attacker controlling a second account on the same upstrea
Authenticated users with uma_protection role in Red Hat Keycloak can bypass User-Managed Access policy validation to gai
Privilege escalation in Keycloak (Red Hat Build of Keycloak) lets an authenticated delegated admin with management right
Denial of service in Red Hat build of Keycloak allows remote unauthenticated attackers to exhaust CPU and worker threads
Denial of Service in Red Hat Build of Keycloak allows unauthenticated remote attackers to exhaust server resources by su
Session fixation in Keycloak's login-actions endpoints allows remote attackers to hijack authenticated sessions and take
Authorization code forgery in Red Hat Keycloak enables unauthenticated attackers to escalate privileges to admin-level a
Stored Cross-Site Scripting in Red Hat Build of Keycloak lets an authenticated administrator with `manage-client` permis
Open redirect in Red Hat Build of Keycloak allows authenticated attackers with control over another path on the same web
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today