CVE-2025-14083
Keycloak-server: keycloak: improper access control in admin rest api leads to information disclosure
- State
- Published
- Severity
- 2.7 Low
- Published
- Jan 21, 2026
- Updated
- Apr 2, 2026
- Reserved
- Dec 5, 2025
Description
A flaw was found in the Keycloak Admin REST API. This vulnerability allows the exposure of backend schema and rules, potentially leading to targeted attacks or privilege escalation via improper access control.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 2.7 Low | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N | redhat |
Weaknesses
- CWE-284 Improper Access Control
Affected Products
| Product | Versions |
|---|---|
Red Hat build of Keycloak 26.4Red Hat |
|
Red Hat build of Keycloak 26.4Red Hat |
|
Red Hat build of Keycloak 26.4Red Hat |
|
Red Hat build of Keycloak 26.4.11Red Hat |
References
- RHSA-2026:6477vendor-advisory
- RHSA-2026:6478vendor-advisory
- https://access.redhat.com/security/cve/CVE-2025-14083vdb-entry
- RHBZ#2419086issue-tracking
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.