EUVD-2026-53383
GHSA-m28w-c4hx-9fvg
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Network vector confirmed by web-based admin interface; PR:L reflects delegated admin role requirement; C:L and I:L for directory disclosure and unintended user import; no availability impact.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Lifecycle Timeline
1DescriptionCVE.org
A flaw was found in the LDAP storage provider of Keycloak, which is used to federate user identities from external directories. The issue occurs when a delegated administrator performs a search using a specific LDAP entry Distinguished Name (DN). Due to missing validation, the system allows lookups for users located outside the configured search boundary, leading to the disclosure of account information from unauthorized parts of the directory and unintended importing of those users into local storage.
AnalysisAI
Keycloak's LDAP storage provider allows delegated administrators to bypass configured search boundaries by supplying a crafted Distinguished Name (DN), exposing account information from unauthorized directory subtrees and triggering unintended user imports into Keycloak local storage. Affected deployments include Red Hat Build of Keycloak, Red Hat Single Sign-On 7, Red Hat Data Grid 8, and the JBoss EAP Expansion Pack. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires three specific conditions: (1) Keycloak must be configured with an active LDAP user federation storage provider - deployments using only local Keycloak storage or non-LDAP identity providers (SAML, OIDC, social) are not affected; (2) the attacker must hold delegated administrator privileges within Keycloak (confirmed by CVSS PR:L), meaning general end users and unauthenticated attackers cannot exploit this; (3) the attacker must be able to initiate a user search or lookup operation via the delegated admin interface using a crafted DN value. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 5.4 (Medium) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N accurately reflects the bounded nature of this flaw. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A malicious or compromised delegated administrator in a Keycloak environment with active LDAP federation constructs a user lookup request referencing a DN outside the configured search base - for example, targeting a DN in a sibling organizational unit or parent container not intended to be federated. Keycloak processes the request without boundary validation, returning account attributes for the out-of-scope directory entry and potentially importing that user into Keycloak local storage, where they may gain unintended access to applications protected by the SSO realm. … |
| Remediation | Apply the vendor patch once Red Hat publishes an updated package via the advisory at https://access.redhat.com/security/cve/CVE-2026-16071; a specific patched release version is not confirmed in the available data, so monitor the Red Hat Bugzilla entry (https://bugzilla.redhat.com/show_bug.cgi?id=2501720) for a confirmed fix version. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Red Hat Build Of Keycloak
View allAccount takeover in Keycloak (Red Hat build of Keycloak, Red Hat Single Sign-On 7) arises because the IdP-initiated SAML
Account takeover in Red Hat Build of Keycloak allows an unauthenticated attacker to abuse the reset-credentials flow in
Authentication bypass in Red Hat Build of Keycloak (and Red Hat Single Sign-On 7) lets an unauthenticated attacker forge
Privilege escalation in Red Hat Build of Keycloak's Dynamic Client Registration (DCR) grants an attacker with low-privil
Authorization bypass in the Keycloak Policy Enforcer allows any authenticated user to circumvent all enforced access con
URI normalization bypass in Keycloak's Authorization Services PathMatcher allows authenticated low-privilege users to re
Privilege escalation in Keycloak's Dynamic Client Registration (DCR) component allows attackers with standard user accou
Token exchange in Keycloak bypasses Google Workspace domain allowlist restrictions, enabling any valid Google account ho
Signature-verification bypass in Keycloak (and Red Hat's Keycloak-based products such as Red Hat Single Sign-On 7 and Re
Tenant-restriction bypass in Keycloak's Microsoft identity provider integration allows attackers holding any valid Micro
Session hijacking via SAML assertion replay in Keycloak's SAML broker component allows adjacent-network attackers to aut
Open redirect in Red Hat build of Keycloak permits remote attackers to send victims to attacker-controlled hosts by abus
Same weakness CWE-269 – Improper Privilege Management
View allSame technique Privilege Escalation
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today