CVE-2025-13881: Keycloak Services Vulnerability Allows Limited Admins to Access Sensitive Attributes
Summary
CVE-2025-13881: A flaw was found in Keycloak Admin API. Affects org.keycloak:keycloak-services versions < 26.5.2. Fixed in 26.5.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Keycloak is an open-source identity and access management solution designed to secure applications and services with minimal effort. It provides features such as single sign-on, user federation, identity brokering, and social login. The Keycloak Admin API is a critical component that allows administrators to manage users, roles, and permissions. However, a vulnerability has been identified that compromises the security of sensitive user attributes.
Vulnerability Detail
A flaw was found in the Keycloak Admin API that allows an administrator with limited privileges to retrieve sensitive custom attributes through the /unmanagedAttributes endpoint. This bypasses the User Profile visibility settings, potentially exposing sensitive information to unauthorized users. The vulnerability stems from insufficient access controls within the API, which could lead to data leaks and privacy violations.
How To Fix
Latest published version: 26.8.1 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
26.5.2
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, administrators can limit access to the /unmanagedAttributes endpoint by implementing stricter role-based access controls until the package is updated. Ensure that only trusted administrators have access to sensitive user attributes.
Conclusion
The CVE-2025-13881 vulnerability in Keycloak Services poses a risk to sensitive user attributes due to insufficient access controls. It is crucial for administrators to update their packages promptly and consider implementing additional security measures to mitigate potential risks.
See every vulnerability recorded for org.keycloak:keycloak-services →
FAQ
CVE-2025-13881 is a vulnerability in the Keycloak Admin API that allows limited privilege administrators to access sensitive custom attributes.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
The vulnerability could lead to unauthorized access to sensitive user information, resulting in privacy violations and potential data leaks.
The CVSS score of this vulnerability is 2.7, indicating a low severity level.
To protect your application, update the Keycloak Services package to version 26.5.2 or later and implement stricter access controls in the meantime.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.keycloak:keycloak-services.
