EUVD-2026-41556
GHSA-p39j-8498-pcjw
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Scope changed to C because token injection directly affects downstream relying-party applications outside the vulnerable Keycloak component; PR:L reflects required delegated admin account.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
Lifecycle Timeline
1DescriptionCVE.org
A flaw was found in the ClientResource component of Keycloak's admin services when Fine-Grained Admin Permissions (FGAP) v2 is enabled. This issue allows a delegated administrator, who should only have limited control over specific clients, to attach or remove hidden client scopes that they are not authorized to see or manage. As a result, an attacker could inject unauthorized data or permissions into the security tokens issued to end-users, potentially tricking other applications into granting higher levels of access than intended.
AnalysisAI
Keycloak's ClientResource admin API component, when Fine-Grained Admin Permissions v2 (FGAP v2) is enabled, permits a delegated administrator to attach or detach hidden client scopes that fall outside their authorized management boundary. By injecting unauthorized scopes into client configurations, an attacker can manipulate the contents of OAuth2/OIDC security tokens issued to end-users, causing downstream applications to grant privilege levels beyond what the original access policy intended. No public exploit is identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog; however, the token-injection impact class carries meaningful risk in federated identity deployments.
Technical ContextAI
Keycloak is an open-source Identity and Access Management platform implementing OAuth 2.0 and OpenID Connect. Fine-Grained Admin Permissions v2 (FGAP v2) is an advanced delegation feature allowing realm administrators to grant limited admin rights over specific resources - such as individual clients - to sub-administrators. The ClientResource component within the admin REST API exposes endpoints for managing client scope assignments. The flaw is an authorization gap in this component: scope enumeration or modification endpoints fail to enforce visibility constraints, allowing a delegated admin to reference and manipulate scopes that are deliberately hidden from them. While CWE is not formally assigned, this maps to CWE-863 (Incorrect Authorization) - the system authenticates the actor correctly but fails to verify that the authorized action applies only to resources within the actor's permitted boundary. Affected products per CPE include cpe:2.3:a:red_hat:red_hat_build_of_keycloak, cpe:2.3:a:red_hat:red_hat_single_sign-on_7, cpe:2.3:a:red_hat:red_hat_jboss_enterprise_application_platform_expansion_pack, and cpe:2.3:a:red_hat:red_hat_data_grid_8 - all wildcard on version, indicating broad version coverage within each product line.
RemediationAI
Consult the Red Hat security advisory at https://access.redhat.com/security/cve/CVE-2026-14614 for the vendor-released patched version - no specific fix version was confirmed in the available intelligence data at time of analysis. As an immediate compensating control, disabling Fine-Grained Admin Permissions v2 (FGAP v2) in affected Keycloak realms eliminates the vulnerable code path entirely; the trade-off is loss of delegated-admin granularity, requiring operators to reassign those admin tasks to full realm administrators. Where FGAP v2 cannot be disabled, minimize the number of delegated administrator accounts and restrict client-management permissions to only the principals that operationally require them, reducing the pool of potential abusers. Audit existing client scope assignments for unexpected or unauthorized scopes that may indicate prior exploitation. Track fix availability via https://bugzilla.redhat.com/show_bug.cgi?id=2496889.
More in Red Hat Build Of Keycloak
View allAccount takeover in Red Hat Build of Keycloak allows an unauthenticated attacker to abuse the reset-credentials flow in
Account takeover in Keycloak (Red Hat build of Keycloak, Red Hat Single Sign-On 7) arises because the IdP-initiated SAML
Authentication bypass in Red Hat Build of Keycloak (and Red Hat Single Sign-On 7) lets an unauthenticated attacker forge
Privilege escalation in Red Hat Build of Keycloak's Dynamic Client Registration (DCR) grants an attacker with low-privil
Authorization bypass in the Keycloak Policy Enforcer allows any authenticated user to circumvent all enforced access con
URI normalization bypass in Keycloak's Authorization Services PathMatcher allows authenticated low-privilege users to re
Privilege escalation in Keycloak's Dynamic Client Registration (DCR) component allows attackers with standard user accou
Token exchange in Keycloak bypasses Google Workspace domain allowlist restrictions, enabling any valid Google account ho
Signature-verification bypass in Keycloak (and Red Hat's Keycloak-based products such as Red Hat Single Sign-On 7 and Re
Tenant-restriction bypass in Keycloak's Microsoft identity provider integration allows attackers holding any valid Micro
Session hijacking via SAML assertion replay in Keycloak's SAML broker component allows adjacent-network attackers to aut
Open redirect in Red Hat build of Keycloak permits remote attackers to send victims to attacker-controlled hosts by abus
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today