Threats Tagged 'cve-2025-14559'

Red Hat has released a security advisory for the Red Hat build of Keycloak 26.4.9 images used on OpenShift Container Platform. The update addresses multiple security vulnerabilities including improper invitation token validation, acceptance of disabled identity providers for JWT authorization, incorrect ownership checks, unauthorized modification of user attributes, unauthorized token issuance for disabled users, and exposure of sensitive user attributes via the Admin API. These issues could allow unauthorized access or privilege escalation within Keycloak deployments. The advisory provides updated container images to remediate these vulnerabilities.

Red Hat build of Keycloak 26.4.9 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single sign-on capabilities for web and mobile applications. Security fixes: * Unauthorized organization registration via improper invitation token validation (CVE-2026-1529) * Disabled identity providers are still accepted for JWT Authorization Grant (CVE-2026-1486) * Incorrect ownership checks in /uma-policy/ (CVE-2025-14778) * Unauthorized modification of unmanaged user attributes by administrators (CVE-2026-0871) * keycloak-services: Business logic flaw allows unauthorized token issuance for disabled users (CVE-2025-14559) * Limited administrator can retrieve sensitive user attributes via Admin API (CVE-2025-13881)

A flaw was found in the keycloak-services component of Keycloak. This vulnerability allows the issuance of access and refresh tokens for disabled users, leading to unauthorized use of previously revoked privileges, via a business logic vulnerability in the Token Exchange implementation when a privileged client invokes the token exchange flow.

MediumVulnerabilityUnited StatesGermanyUnited Kingdom+7#cve#cve-2025-14559#cwe-840