← Vulnerability feed

Vulnerability record · CVE-2026-9099 · published 25 June 2026

CVE-2026-9099: Redhat build of keycloak insecure direct object reference vulnerability

Redhat · Build Of Keycloak

A flaw was found in Keycloak. A missing authorization check in the GroupResource.addChild() endpoint within the Admin REST API allows an authenticated user with limited administrative privileges to reparent any existing group. When Fine-Grained Admin Permissions v2 (FGAPv2) is enabled, an attacker with management rights over a single low-privilege group can reparent a highly privileged group (such as one possessing the realm-admin role) under their managed group. Because group permissions follow a hierarchical structure, this action unauthorizedly grants the attacker management and password-reset capabilities over the members of the targeted privileged group. An attacker can exploit this to reset an administrator's password, compromise the account, and achieve a full realm takeover, leading to a complete compromise of confidentiality, integrity, and availability.

7.7 CVSS 3.1 High EPSS 0.49% · top 60.3% CWE-639 · Insecure direct object reference
7.7CVSS 3.1 base score
0.49%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
13References
15 Jul 2026Last modified by NVD

Description

A flaw was found in Keycloak. A missing authorization check in the GroupResource.addChild() endpoint within the Admin REST API allows an authenticated user with limited administrative privileges to reparent any existing group. When Fine-Grained Admin Permissions v2 (FGAPv2) is enabled, an attacker with management rights over a single low-privilege group can reparent a highly privileged group (such as one possessing the realm-admin role) under their managed group. Because group permissions follow a hierarchical structure, this action unauthorizedly grants the attacker management and password-reset capabilities over the members of the targeted privileged group. An attacker can exploit this to reset an administrator's password, compromise the account, and achieve a full realm takeover, leading to a complete compromise of confidentiality, integrity, and availability.

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://access.redhat.com/errata/RHSA-2026:30049 Third Party Advisory
https://access.redhat.com/errata/RHSA-2026:30050 Third Party Advisory
https://access.redhat.com/errata/RHSA-2026:30083 Third Party Advisory
https://access.redhat.com/errata/RHSA-2026:30084 Third Party Advisory
https://access.redhat.com/security/cve/CVE-2026-9099 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2480182 Third Party Advisory
https://access.redhat.com/errata/RHSA-2026:30049 Third Party Advisory
https://access.redhat.com/errata/RHSA-2026:30050 Third Party Advisory
https://access.redhat.com/errata/RHSA-2026:30083 Third Party Advisory
https://access.redhat.com/errata/RHSA-2026:30084 Third Party Advisory
https://access.redhat.com/security/cve/CVE-2026-9099 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2480182 Third Party Advisory
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-9099.json Third Party Advisory

Track CVE-2026-9099 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2026-16442Redhat build of keycloak origin validation error vulnerabilityA flaw was found in the SAML broker component of Keycloak, which is used to manage identity federation and user authentication. The issue occurs beca…EPSS 0.31%9.1CVE-2026-16443Redhat build of keycloak improper verification of cryptographic signature vulnerabilityA flaw was found in the SAML metadata import functionality of the keycloak-services component, which is the core engine for identity brokering in Red…EPSS 0.26%8.8CVE-2026-15572Redhat build of keycloak type confusion vulnerabilityA flaw was found in Keycloak's Dynamic Client Registration (DCR) security policy management. The "Allowed Protocol Mapper Types" policy, which restri…EPSS 0.65%8.8CVE-2026-9704Redhat build of keycloak vulnerabilityA flaw was found in Keycloak. An authenticated user with low privileges can exploit this vulnerability by sending an oversized subject_token JSON Web…EPSS 0.59%8.8CVE-2026-3047Redhat build of keycloak vulnerabilityA flaw was found in org.keycloak.broker.saml. When a disabled Security Assertion Markup Language (SAML) client is configured as an Identity Provider …EPSS 0.86%8.8CVE-2023-6787Redhat build of keycloak improper authentication vulnerabilityA flaw was found in Keycloak that occurs from an error in the re-authentication mechanism within org.keycloak.authentication. This flaw allows hijack…EPSS 0.74%8.1CVE-2026-18967Redhat build of keycloak authentication bypass by capture-replay vulnerabilityA flaw was found in the SAML broker component of Keycloak, an identity and access management solution. When configured as a SAML broker using the IdP…EPSS 0.23%8.1CVE-2026-16102Redhat build of keycloak improper access control vulnerabilityA flaw was found in the Dynamic Client Registration (DCR) component of Keycloak, an identity and access management solution. The default DCR policy f…EPSS 0.46%

Source: NIST National Vulnerability Database (record CVE-2026-9099), CISA KEV, FIRST EPSS (scores of 2026-09-28). This page is refreshed as NVD updates the record.