What’s Vulnerable › Vulnerabilities

CVE-2025-14777: Keycloak: keycloak idor in realm client creating/deleting

• Severity: medium (CVSS 6.0 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-12-16 · updated 2026-10-07
• Weakness: CWE-289

Description

A flaw was found in Keycloak. An IDOR (Broken Access Control) vulnerability exists in the admin API endpoints for authorization resource management, specifically in ResourceSetService and PermissionTicketService. The system checks authorization against the resourceServer (client) ID provided in the API request, but the backend database lookup and modification operations (findById, delete) only use the resourceId. This mismatch allows an authenticated attacker with fine-grained admin permissions for one client (e.g., Client A) to delete or update resources belonging to another client (Client B) within the same realm by supplying a valid resource ID.

Affected products

• Red Hat build of Keycloak 26.4: all versions — fixed in 26.4-14, 26.4.11-1

How to fix

Upgrade to a fixed version: Red Hat build of Keycloak 26.4 26.4-14, 26.4.11-1. Check the vendor advisory for mitigations.

References

• https://access.redhat.com/errata/RHSA-2026:6477
• https://access.redhat.com/errata/RHSA-2026:6478
• https://access.redhat.com/security/cve/CVE-2025-14777
• https://bugzilla.redhat.com/show_bug.cgi?id=2422596

Get alerted when CVE-2025-14777 or the next vulnerability affects your stack