Skip to content
Keycloak Admin API Vulnerabilities Expose User Management Risks

Keycloak Admin API Vulnerabilities Expose User Management Risks

First seen 13 Oct 2026, 15:31 UTC •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 13, 2026 at 16:35 UTC
  • •CVE-2026-94000 allows unauthorized elevation of privileges via group membership.
  • •CVE-2026-94001 enables credential deletion without proper permission checks.
  • •Both vulnerabilities were disclosed on 2026-09-19 and affect Keycloak 26.7.3.

Two vulnerabilities in Keycloak's Admin REST API have been disclosed, affecting user management functionalities. CVE-2026-94000 allows a delegated administrator to gain full administrative control by improperly adding users to groups that confer elevated roles without adequate checks. CVE-2026-94001 permits deletion of user credentials without verifying the necessary permissions, potentially locking users out of their accounts. Both vulnerabilities were published on 2026-09-19 and have a CVSS score of 6.6 and 6.5, respectively. The flaws were reproduced against Keycloak version 26.7.3. Administrators are urged to review their permissions and apply necessary checks to mitigate these risks.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-08-02
CVE-2026-18571 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-09-19
CVE-2026-94000 published
Keycloak vulnerability allows unauthorized group membership leading to privilege escalation.
Article 1
2026-09-19
CVE-2026-94001 published
Keycloak vulnerability permits deletion of user credentials without proper permission checks.
Article 2

More articles in this cluster (2)

Following this threat?

Track CVE-2026-18571 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (7)

1 / 4

Common questions

What versions of Keycloak are affected?
Keycloak version 26.7.3 is confirmed to be affected by these vulnerabilities.
What actions should administrators take?
Administrators should review user permissions and apply necessary checks to prevent unauthorized access.
Are these vulnerabilities currently being exploited?
No confirmed exploitation has been reported; both vulnerabilities are disclosed and patched.