Vulnerability Details CVE-2026-18201
Keycloak provides a way to manage identity providers and organizations through its administrative API. A flaw was discovered where an administrator with permission to manage identity providers could link a new provider to an organization without having the required permissions to manage that organization. This could allow an unauthorized administrator to influence how users log into specific organizations.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.003
EPSS Ranking 20.7%
CVSS Severity
CVSS v3 Score 5.5
References
Products affected by CVE-2026-18201
-
cpe:2.3:a:redhat:build_of_keycloak:-