← Vulnerability feed

Vulnerability record · CVE-2026-14209 · published 30 June 2026

CVE-2026-14209: Redhat build of keycloak insecure direct object reference vulnerability

Redhat · Build Of Keycloak

A vulnerability was discovered in Keycloak's Admin UI extension that allows certain administrative users to bypass security restrictions. When Fine-Grained Admin Permissions (FGAPv2) are enabled, an administrator who should only be able to search for users (but not view their full details) can use a specific "brute-force-user" endpoint to access a user's full profile. This includes sensitive information and security metadata. The issue occurs because the system fails to check if the administrator has the required "view" permission for that specific user when using this particular search path.

4.3 CVSS 3.1 Medium EPSS 0.39% · top 69.7% CWE-639 · Insecure direct object reference
4.3CVSS 3.1 base score
0.39%EPSS exploitation probability, 30 days
NoNot in CISA KEV
2Affected product versions listed by NVD
6References
5 Aug 2026Last modified by NVD

Description

A vulnerability was discovered in Keycloak's Admin UI extension that allows certain administrative users to bypass security restrictions. When Fine-Grained Admin Permissions (FGAPv2) are enabled, an administrator who should only be able to search for users (but not view their full details) can use a specific "brute-force-user" endpoint to access a user's full profile. This includes sensitive information and security metadata. The issue occurs because the system fails to check if the administrator has the required "view" permission for that specific user when using this particular search path.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Affected products

2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://access.redhat.com/errata/RHSA-2026:50846
https://access.redhat.com/errata/RHSA-2026:50847
https://access.redhat.com/errata/RHSA-2026:50848
https://access.redhat.com/errata/RHSA-2026:50849
https://access.redhat.com/security/cve/CVE-2026-14209 Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2494837 Vendor Advisory

Track CVE-2026-14209 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2026-16442Redhat build of keycloak origin validation error vulnerabilityA flaw was found in the SAML broker component of Keycloak, which is used to manage identity federation and user authentication. The issue occurs beca…EPSS 0.31%9.6CVE-2025-12543Redhat build of apache camel improper input validation vulnerabilityA flaw was found in the Undertow HTTP server core, which is used in WildFly, JBoss EAP, and other Java applications. The Undertow library fails to pr…EPSS 1.3%9.1CVE-2026-16443Redhat build of keycloak improper verification of cryptographic signature vulnerabilityA flaw was found in the SAML metadata import functionality of the keycloak-services component, which is the core engine for identity brokering in Red…EPSS 0.26%9.1CVE-2026-28369Redhat build of apache camel - hawtio http request smuggling vulnerabilityA flaw was found in Undertow. When Undertow receives an HTTP request where the first header line starts with one or more spaces, it incorrectly proce…EPSS 0.89%9.1CVE-2026-28368Redhat build of apache camel - hawtio http request smuggling vulnerabilityA flaw was found in Undertow. This vulnerability allows a remote attacker to construct specially crafted requests where header names are parsed diffe…EPSS 0.89%9.1CVE-2026-28367Redhat build of apache camel - hawtio http request smuggling vulnerabilityA flaw was found in Undertow. A remote attacker can exploit this vulnerability by sending `\r\r\r` as a header block terminator. This can be used for…EPSS 0.89%8.8CVE-2026-15572Redhat build of keycloak type confusion vulnerabilityA flaw was found in Keycloak's Dynamic Client Registration (DCR) security policy management. The "Allowed Protocol Mapper Types" policy, which restri…EPSS 0.65%8.8CVE-2026-9704Redhat build of keycloak vulnerabilityA flaw was found in Keycloak. An authenticated user with low privileges can exploit this vulnerability by sending an oversized subject_token JSON Web…EPSS 0.59%

Source: NIST National Vulnerability Database (record CVE-2026-14209), CISA KEV, FIRST EPSS (scores of 2026-10-03). This page is refreshed as NVD updates the record.