CVE-2026-14614: Authorization Bypass Through User-Controlled Key in Red Hat Red Hat build of Keycloak 26.4
A flaw was found in the ClientResource component of Keycloak's admin services when Fine-Grained Admin Permissions (FGAP) v2 is enabled. This issue allows a delegated administrator, who should only have limited control over specific clients, to attach or remove hidden client scopes that they are not authorized to see or manage. As a result, an attacker could inject unauthorized data or permissions into the security tokens issued to end-users, potentially tricking other applications into granting higher levels of access than intended.
AI Analysis
Technical Summary
This vulnerability arises from a missing authorization check in the ClientResource admin REST API of Keycloak when FGAP v2 is enabled. A delegated administrator who should only have limited control over specific clients can bypass fine-grained authorization boundaries to assign or remove hidden client scopes that they are not authorized to see or manage. Exploitation requires the attacker to already hold delegated administrator privileges and knowledge of internal resource identifiers (UUIDs). Successful exploitation can modify the contents of tokens issued by Keycloak, potentially leading to unauthorized actions in applications relying on those tokens. The CVSS 3.1 base score is 5.4 (medium severity) with network attack vector, low complexity, low privileges required, no user interaction, and low confidentiality and integrity impacts. Red Hat has published an advisory but no explicit patch or fix version is stated in the input data.
Potential Impact
An attacker with delegated administrator privileges and knowledge of internal UUIDs can bypass fine-grained admin permission controls to modify hidden client scopes. This enables injection of unauthorized data or permissions into security tokens issued by Keycloak, potentially tricking downstream applications into granting elevated access. The impact is limited by the prerequisite of delegated admin access and internal knowledge, and the confidentiality and integrity impacts are rated low. There is no availability impact.
Mitigation Recommendations
The vendor advisory does not explicitly state that a fix is currently available or provide a remediation level. Patch status is not yet confirmed—check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-14614 for current remediation guidance. Until a fix is applied, restrict delegated administrator roles to trusted users and monitor for unauthorized token modifications. Red Hat has released security updates including Keycloak 26.4.14 addressing multiple issues; applying this update is recommended if it includes a fix for this vulnerability. Backup existing installations before applying updates.
CVE-2026-14614: Authorization Bypass Through User-Controlled Key in Red Hat Red Hat build of Keycloak 26.4
Description
A flaw was found in the ClientResource component of Keycloak's admin services when Fine-Grained Admin Permissions (FGAP) v2 is enabled. This issue allows a delegated administrator, who should only have limited control over specific clients, to attach or remove hidden client scopes that they are not authorized to see or manage. As a result, an attacker could inject unauthorized data or permissions into the security tokens issued to end-users, potentially tricking other applications into granting higher levels of access than intended.
CVSS v3.1
Score 5.4medium
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability arises from a missing authorization check in the ClientResource admin REST API of Keycloak when FGAP v2 is enabled. A delegated administrator who should only have limited control over specific clients can bypass fine-grained authorization boundaries to assign or remove hidden client scopes that they are not authorized to see or manage. Exploitation requires the attacker to already hold delegated administrator privileges and knowledge of internal resource identifiers (UUIDs). Successful exploitation can modify the contents of tokens issued by Keycloak, potentially leading to unauthorized actions in applications relying on those tokens. The CVSS 3.1 base score is 5.4 (medium severity) with network attack vector, low complexity, low privileges required, no user interaction, and low confidentiality and integrity impacts. Red Hat has published an advisory but no explicit patch or fix version is stated in the input data.
Potential Impact
An attacker with delegated administrator privileges and knowledge of internal UUIDs can bypass fine-grained admin permission controls to modify hidden client scopes. This enables injection of unauthorized data or permissions into security tokens issued by Keycloak, potentially tricking downstream applications into granting elevated access. The impact is limited by the prerequisite of delegated admin access and internal knowledge, and the confidentiality and integrity impacts are rated low. There is no availability impact.
Mitigation Recommendations
The vendor advisory does not explicitly state that a fix is currently available or provide a remediation level. Patch status is not yet confirmed—check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-14614 for current remediation guidance. Until a fix is applied, restrict delegated administrator roles to trusted users and monitor for unauthorized token modifications. Red Hat has released security updates including Keycloak 26.4.14 addressing multiple issues; applying this update is recommended if it includes a fix for this vulnerability. Backup existing installations before applying updates.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- redhat
- Date Reserved
- 2026-07-03T15:13:06.650Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
- Vendor Advisory Urls
- [{"url":"https://access.redhat.com/security/cve/CVE-2026-14614","vendor":"Red Hat"}]
Threat ID: 6a47de1b27e9c79719f36ec5
Added to database: 07/03/2026, 16:06:51 UTC
Last enriched: 08/06/2026, 13:14:54 UTC
Last updated: 08/17/2026, 00:41:09 UTC
Views: 148
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.