Threats Tagged 'cve-2025-14777'

Red Hat has released updated images for the Red Hat build of Keycloak 26.4.11 addressing multiple security vulnerabilities. These include improper access control issues, information disclosure, privilege escalation, server-side request forgery (SSRF), denial of service, and token replay vulnerabilities affecting the Keycloak Admin REST API, Operator, and related components. The update aligns with the standalone Keycloak product release and is intended for use within OpenShift Container Platform deployments.

Red Hat has released an important security advisory for Red Hat build of Keycloak 26.4.11 addressing multiple vulnerabilities including improper access control, information disclosure, privilege escalation, server-side request forgery, denial of service, and token replay issues. These vulnerabilities affect the Admin REST API, UMA 2.0 Protection API, account management endpoints, and other components. The update aims to fix these security issues to protect authentication and single sign-on capabilities provided by Keycloak.

A flaw was found in Keycloak. An IDOR (Broken Access Control) vulnerability exists in the admin API endpoints for authorization resource management, specifically in ResourceSetService and PermissionTicketService. The system checks authorization against the resourceServer (client) ID provided in the API request, but the backend database lookup and modification operations (findById, delete) only use the resourceId. This mismatch allows an authenticated attacker with fine-grained admin permissions for one client (e.g., Client A) to delete or update resources belonging to another client (Client B) within the same realm by supplying a valid resource ID.