EUVD-2026-80854
GHSA-j7cq-x5cp-qpcx
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Attacker must already hold the privileged impersonation role (PR:H) and reaches it over the network (AV:N); successful escalation yields full realm-admin control, so C/I/A all High.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
Lifecycle Timeline
3DescriptionCVE.org
Keycloak is an open-source identity and access management solution. A vulnerability was discovered where a user with the impersonation role can impersonate a realm administrator. This allows the attacker to gain full administrative control over the realm, including the ability to manage users, clients, and roles.
AnalysisAI
Privilege escalation in Red Hat Build of Keycloak allows an account already holding the realm 'impersonation' role to impersonate a realm administrator and thereby seize full administrative control over that realm, including management of users, clients, and roles. Affected builds are 26.4 before 26.4.16 and 26.6 before 26.6.7. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated Keycloak account that has already been granted the realm 'impersonation' role (a delegated admin capability, hence CVSS PR:H). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine but access-gated privilege-escalation issue (CWE-862, missing authorization). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade Red Hat Build of Keycloak to 26.4.16 (for the 26.4 stream) or 26.6.7 (for the 26.6 stream) as delivered by Red Hat errata RHSA-2026:68276, RHSA-2026:68277, RHSA-2026:68278, and RHSA-2026:68280, and consult https://access.redhat.com/security/cve/CVE-2026-17526 for the authoritative affected-product matrix. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Red Hat Build of Keycloak deployments and identify any instance running 26.4.x prior to 26.4.16 or 26.6.x prior to 26.6.7, then immediately audit every user and service account holding the realm 'impersonation' role or any delegated admin role, revoking assignments that are not strictly business-justified and separating impersonation duties from administrative duties wherever possible; enable and centralize Keycloak admin and impersonation event logging and alert on any impersonation session or realm-admin role change. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remot
The org.keycloak.services.resources.SocialResource.callback method in JBoss KeyCloak before 1.0.3.Final allows remote at
An unconstrained memory consumption vulnerability was discovered in Keycloak. Rated high severity (CVSS 7.7), this vulne
Due to improper authorization, Red Hat Single Sign-On is vulnerable to users performing actions that they should not be
It was found that the Keycloak Node.js adapter 2.5 - 3.0 did not handle invalid tokens correctly. Rated critical severit
A privilege escalation flaw was found in the token exchange feature of keycloak. Rated critical severity (CVSS 9.8), thi
A vulnerability was found in keycloak 7.x, when keycloak is configured with LDAP user federation and StartTLS is used in
A flaw was found in keycloak in versions before 13.0.0. Rated critical severity (CVSS 9.6), this vulnerability is remote
A flaw was found in Keycloak that prevents certain schemes in redirects, but permits them if a wildcard is appended to t
A flaw was found in Keycloak. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack c
A flaw was found in Keycloak before 13.0.0, where it is possible to force the server to call out an unverified URL using
Keycloak's SAML identity provider broker fails to enforce client disabled status during IdP-initiated SSO flows, allowin
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today