Start with Identity
Subscribe
Identity CVE · Other

CVE-2025-13881Keycloak Admin API auth bypass to custom attributes

high
Product: KeycloakVendor: Red HatCWE-266Disclosed: 2025-11-20Status: PatchedNVD ↗

What broke

The Keycloak Admin API did not enforce the intended permission on sensitive custom user attributes (CWE-266, incorrect privilege assignment). A lesser admin or a token with a narrower role could read them. Red Hat patched.

Why it matters

Custom attributes are where people hide government IDs, recovery emails, and internal employee numbers. An Admin API authz gap is a privacy incident and a recovery-channel takeover in one.

What to do

  • Upgrade Keycloak.
  • Audit who can call the Admin API. Service accounts with realm-management are the usual over-grant.
  • Stop putting secrets in user attributes. Use a vault.

Sources

Related identity CVEs

Know a primary source we should add, or a patch status that has changed? Email [email protected]. See all briefs in the identity CVE catalog, or volunteer as a CVE Analyst.
Compiled from vendor advisories, NVD, CISA KEV, and public research. CVSS figures can disagree across NVD and the CNA. Confirm affected versions against the vendor advisory before you patch. Independent, community-driven analysis. See the disclaimer.