CVE-2016-8629: org.keycloak:keycloak-core - Service Account User Deletion Permissions Bypass
Summary
CVE-2016-8629: Moderate severity vulnerability that affects org.keycloak:keycloak-core. Affects org.keycloak:keycloak-core versions < 2.4.0. Fixed in 2.4.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
org.keycloak:keycloak-core is a Maven package that provides core functionality for Red Hat Keycloak, an open-source identity and access management solution. It is responsible for handling user authentication, authorization, and user management within Keycloak. This package is widely used in various applications and systems that require secure user management and authentication capabilities.
Vulnerability Detail
This vulnerability, identified as CVE-2016-8629, affects Red Hat Keycloak versions prior to 2.4.0. It arises from a flaw in the permission checking mechanism when processing service account user deletion requests sent to the Keycloak REST server. An attacker with service account authentication can exploit this vulnerability to bypass normal permissions and delete users in a separate realm. This can lead to unauthorized access, data loss, and disruption of user management functionality within affected systems.
How To Fix
Latest published version: 26.8.1 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.4.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the recommended fix by upgrading to the patched version of org.keycloak:keycloak-core.
Conclusion
The vulnerability in org.keycloak:keycloak-core allows an attacker to bypass permissions and delete users in a separate realm. To mitigate this vulnerability, it is crucial to upgrade to version 2.4.0 or later of the package. This will ensure that the necessary fixes are applied and protect the system from potential exploitation. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for org.keycloak:keycloak-core →
FAQ
org.keycloak:keycloak-core is a Maven package that provides core functionality for Red Hat Keycloak, an open-source identity and access management solution. It handles user authentication, authorization, and user management within Keycloak.
This vulnerability allows an attacker with service account authentication to bypass permissions and delete users in a separate realm. This can result in unauthorized access, data loss, and disruption of user management functionality.
To fix this vulnerability, upgrade to version 2.4.0 or later of org.keycloak:keycloak-core.
No, there is no known workaround for this vulnerability. Upgrading to the patched version is the recommended solution.
For more information about this vulnerability, you can refer to the CVE-2016-8629 advisory or contact the Keycloak support team.
Related vulnerabilities
Recent vulnerabilities recorded for org.keycloak:keycloak-core.
