CVE-2026-16105 : A missing authorization check vulnerability was discovered in Keycloak admin REST API name-based composite endpoints. Successful exploitation allows an attacker to remove the manage-users, impersonation, or manage-clients child roles from the built-in admin role, thereby degrading the permissions of other administrators within the same realm.
This issue was originally tracked in the private repository. Migrated by @ahus1 .
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
