CVE-2025-14082: Keycloak Services - Insufficient Authorization in Admin REST API
Summary
CVE-2025-14082: Keycloak Admin REST (Representational State Transfer) API does not properly enforce permissions. Affects org.keycloak:keycloak-services versions < 26.4.7. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Keycloak is an open-source Identity and Access Management solution designed for modern applications and services. It provides features such as single sign-on (SSO), user federation, identity brokering, and social login. The Keycloak Admin REST API allows administrators to manage realms, roles, and users programmatically. However, a vulnerability has been identified in the API that can lead to unauthorized access to sensitive role metadata.
Vulnerability Detail
A flaw was found in the Keycloak Admin REST API, specifically in the endpoint '/admin/realms/{realm}/roles'. This vulnerability arises from insufficient authorization checks, allowing unauthorized users to access sensitive role metadata. The ramifications of this vulnerability include potential information disclosure, which could lead to further exploitation or unauthorized actions within the Keycloak environment. The vulnerability is classified under CWE-284, indicating improper access control.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, administrators can restrict access to the '/admin/realms/{realm}/roles' endpoint by implementing additional security measures, such as IP whitelisting or using a reverse proxy to enforce stricter access controls until the package is updated.
Conclusion
In summary, CVE-2025-14082 represents a significant vulnerability in the Keycloak Admin REST API, allowing unauthorized access to sensitive role metadata. It is crucial for users to update to the latest patched version to mitigate the risk associated with this vulnerability.
See every vulnerability recorded for org.keycloak:keycloak-services →
FAQ
CVE-2025-14082 is a vulnerability in the Keycloak Admin REST API that allows unauthorized access to sensitive role metadata due to insufficient authorization checks.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The potential impacts include unauthorized access to sensitive role metadata, which could lead to further exploitation or unauthorized actions within the Keycloak environment.
Update the Keycloak package in your Maven project by modifying the 'pom.xml' file to include the latest version: <dependency><groupId>org.keycloak</groupId><artifactId>keycloak-services</artifactId><version>26.4.8</version></dependency>.
The CVSS score of this vulnerability is 2.7, indicating a low severity level.
Related vulnerabilities
Recent vulnerabilities recorded for org.keycloak:keycloak-services.
