CVE-2026-18571: Keycloak Services Group Assignment Bypass During User Creation
Summary
CVE-2026-18571: Keycloak-services: keycloak-services: fgap v2 group assignment bypass during user creation. Affects keycloak versions < 26.7.3. Fixed in 26.7.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Keycloak is an open-source identity and access management solution that allows users to secure applications and services with little to no code. It provides features such as single sign-on (SSO), user federation, identity brokering, and social login. The vulnerability in question arises in the user creation component when Fine-Grained Admin Permissions V2 (FGAP V2) is enabled, exposing the system to potential unauthorized access.
Vulnerability Detail
A flaw exists in the user creation functionality of Keycloak when FGAP V2 is enabled. This vulnerability allows a sub-administrator, who has permission to create users, to assign those users to any group, regardless of whether they have the authority to manage those groups. This could lead to unauthorized access to sensitive information or elevated privileges for newly created users, posing a significant security risk.
How To Fix
Minimum fixed version
26.7.3
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, you can restrict the permissions of sub-administrators to prevent them from creating users until the patch is applied. This can be done by modifying the role assignments in the Keycloak admin console to limit access to user creation functionalities.
Conclusion
CVE-2026-18571 is a critical vulnerability in Keycloak that allows unauthorized group assignments during user creation. It is crucial to update to version 26.7.3 or later to mitigate this risk. Until then, restricting sub-administrator permissions can serve as a temporary workaround.
See every vulnerability recorded for keycloak →
FAQ
CVE-2026-18571 is a vulnerability in Keycloak that allows sub-administrators to bypass group assignment restrictions during user creation.
If exploited, this vulnerability can allow unauthorized users to gain access to sensitive information or elevated privileges, compromising the security of your applications.
As a workaround, you should restrict the permissions of sub-administrators to prevent them from creating users until the patch can be applied.
You can find more details in the official vulnerability database or the GitHub repository for Bitnami Keycloak.
You can use Vulert, which monitors and alerts in real-time for open-source vulnerabilities in your software using just a manifest file like package-lock.json.
Related vulnerabilities
Recent vulnerabilities recorded for keycloak.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
