VULNERABILITY INTELLIGENCE

CVE-2026-4629

CVSS score6.5 MEDIUM
EPSS probability0.49%
CISA KEVNot currently listed
Published2026-06-30
Last modified2026-10-25
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

Description

A flaw was found in Keycloak. A highly privileged user with `manage-clients` permission can exploit this vulnerability by injecting a hardcoded role mapper into any client. This action allows the user to bypass existing scope restrictions and inject the `realm-admin` role into generated tokens, resulting in privilege escalation and full administrative access to the realm.

Weakness classification

  • secalert@redhat.com: CWE-266

Primary references