The vulnerability in Red Hat Build of Keycloak arises from a missing authorization check in the generic identity-provider creation REST endpoint. An administrator with permission to manage identity providers but without permission to manage organizations can link identity providers to organizations they are not authorized to manage. This flaw could allow unauthorized administrators to influence user login flows for specific organizations. The issue is assessed as moderate severity by Red Hat, requiring high privileges to exploit. No patch or mitigation that meets Red Hat's standards for ease of use, applicability, or stability is currently available.

Successful exploitation allows a high-privileged administrator to associate identity brokers with organizations they do not have permission to manage, potentially influencing how users authenticate to those organizations. The confidentiality impact is low, integrity impact is high, and availability impact is none. The vulnerability could lead to unauthorized modification of authentication flows but does not directly cause denial of service or data disclosure beyond the scope of the affected organizations.

Red Hat currently states that no mitigation is available or that existing options do not meet their criteria for ease of use, deployment, applicability, or stability. Users should monitor Red Hat advisories for updates. Since the vulnerability requires high-privileged access, limiting administrative permissions to trusted personnel is advisable. Check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-18201 for the latest remediation status.