EUVD-2026-32701
GHSA-4q93-v92x-p89f
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
Lifecycle Timeline
1Blast Radius
ecosystem impact- 60 maven packages depend on org.keycloak:keycloak-server-spi-private (29 direct, 31 indirect)
- 50 maven packages depend on org.keycloak:keycloak-services (22 direct, 28 indirect)
Ecosystem-wide dependent count for version 26.5.0 and other introduced versions.
DescriptionCVE.org
A flaw was found in Keycloak. An authenticated user with existing organization membership can exploit this flaw by accessing user-facing APIs, such as the account API or by requesting an OpenID Connect (OIDC) token with the 'organization' scope. This allows organization metadata to be disclosed in tokens, even after an administrator has explicitly disabled the Organizations feature, potentially leading to incorrect authorization decisions by resource servers.
AnalysisAI
Incorrect authorization enforcement in Red Hat Build of Keycloak allows an authenticated user with existing organization membership to retrieve organization metadata through the account API or via OIDC token requests using the 'organization' scope, even when an administrator has explicitly disabled the Organizations feature. The flaw (CWE-863) means the feature-disabled state is not enforced at the data-access layer, so tokens and API responses continue to carry organization claims. This can cause downstream resource servers that consume those tokens to make incorrect authorization decisions - for example, granting access based on organizational membership that should no longer be recognized. No public exploit code exists and this vulnerability is not listed in CISA KEV at time of analysis.
Technical ContextAI
Keycloak is Red Hat's enterprise-grade Identity and Access Management (IAM) platform, built on the upstream Keycloak project. Its Organizations feature allows grouping of users under organizational tenants with associated metadata embedded in OIDC tokens. The affected component is the token issuance and account API layer: when a user requests an OIDC token with the 'organization' scope or queries the account API, Keycloak should suppress organization claims if the Organizations feature has been administratively disabled. CWE-863 (Incorrect Authorization) describes the root cause - the authorization gate that checks feature-enablement status is not applied consistently across these user-facing endpoints, allowing residual org metadata to surface. The affected product per CPE is cpe:2.3:a:red_hat:red_hat_build_of_keycloak:*:*:*:*:*:*:*:*, with the wildcard version field indicating no version exclusion is recorded in NVD CPE data.
RemediationAI
No specific patched version number is confirmed in the available data - the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-9791 should be monitored for an official errata release containing the fix version. As a compensating control while awaiting the patch, administrators should audit OIDC client configurations to remove or restrict the 'organization' scope from clients used by potentially affected users, which prevents the scope from being requested and limits token enrichment with org metadata; the trade-off is that legitimate organization-aware clients will also lose this scope. Additionally, resource servers should not make authorization decisions solely on the 'organization' claim without cross-validating against a server-side authoritative source, which mitigates the downstream incorrect authorization risk independent of the Keycloak fix. Access to the account API endpoint for users with prior organizational membership can also be restricted at the network or gateway layer as a temporary measure, though this impacts legitimate self-service account management functionality.
More in Red Hat Build Of Keycloak
View allAccount takeover in Red Hat Build of Keycloak allows an unauthenticated attacker to abuse the reset-credentials flow in
Account takeover in Keycloak (Red Hat build of Keycloak, Red Hat Single Sign-On 7) arises because the IdP-initiated SAML
Authentication bypass in Red Hat Build of Keycloak (and Red Hat Single Sign-On 7) lets an unauthenticated attacker forge
Privilege escalation in Red Hat Build of Keycloak's Dynamic Client Registration (DCR) grants an attacker with low-privil
Authorization bypass in the Keycloak Policy Enforcer allows any authenticated user to circumvent all enforced access con
URI normalization bypass in Keycloak's Authorization Services PathMatcher allows authenticated low-privilege users to re
Privilege escalation in Keycloak's Dynamic Client Registration (DCR) component allows attackers with standard user accou
Token exchange in Keycloak bypasses Google Workspace domain allowlist restrictions, enabling any valid Google account ho
Signature-verification bypass in Keycloak (and Red Hat's Keycloak-based products such as Red Hat Single Sign-On 7 and Re
Tenant-restriction bypass in Keycloak's Microsoft identity provider integration allows attackers holding any valid Micro
Session hijacking via SAML assertion replay in Keycloak's SAML broker component allows adjacent-network attackers to aut
Open redirect in Red Hat build of Keycloak permits remote attackers to send victims to attacker-controlled hosts by abus
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today