Search: CVE-2026-37981

CVE-2026-37981 is a medium severity vulnerability in Red Hat build of Keycloak 26.4 that involves broken access control in the Account Resources user lookup endpoint. It allows a remote authenticated user who owns at least one User-Managed Access (UMA) resource to enumerate and harvest personally identifiable information (PII) of all users in the realm by sending crafted requests with arbitrary usernames or email values. Red Hat has released an updated package, Keycloak 26.4.12, that addresses this vulnerability along with others. Users are advised to back up their installations and apply the update. No known exploits are reported in the wild at this time.