Identity CVE · OAuth / OIDC / JWT
CVE-2025-14778Keycloak UMA policy privilege escalation
high
What broke
Keycloak's UMA (User-Managed Access) policy evaluation looked at the first resource and ignored the rest. A request that named an allowed resource first, then a denied one, passed. CWE-266. Red Hat patched.
Why it matters
UMA is how some teams do resource-level authorization in OAuth. Checking only the first item is the authorization equivalent of skip_auth_routes matching a prefix. Fine-grained access that is not fine.
What to do
- Upgrade Keycloak.
- If you built UMA policies, add a regression test that names two resources, one allowed and one denied, in both orders.
Sources
Related identity CVEs
Know a primary source we should add, or a patch status that has changed? Email [email protected]. See all briefs in the identity CVE catalog, or volunteer as a CVE Analyst.
Compiled from vendor advisories, NVD, CISA KEV, and public research. CVSS figures can disagree across NVD and the CNA. Confirm affected versions against the vendor advisory before you patch. Independent, community-driven analysis. See the disclaimer.