CVE-2026-2366: Keycloak Admin API Authorization Bypass Vulnerability
Summary
CVE-2026-2366: Keycloak vulnerable to authorization bypass via the Admin API. Affects @keycloak/keycloak-admin-client versions < 26.5.5. No fix is published. How to fix ↓
Also tracked for
- keycloak · Bitnami
The same CVE-2026-2366 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Keycloak is an open-source identity and access management solution designed for modern applications and services. It provides features such as single sign-on, user federation, identity brokering, and social login. The Keycloak Admin API allows administrators to manage users, roles, and permissions programmatically. However, a vulnerability has been identified that allows unauthorized users to access sensitive information about other users' organization memberships.
Vulnerability Detail
A flaw in Keycloak's Admin API enables an authorization bypass, allowing any authenticated user, regardless of their administrative privileges, to enumerate the organization memberships of other users. This vulnerability arises when the Organizations feature is enabled, and an attacker can exploit it by knowing the victim's unique identifier (UUID). The potential ramifications include unauthorized access to sensitive organizational data, which could lead to privacy breaches and further attacks.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, consider disabling the Organizations feature in Keycloak until the package is updated to a secure version. This can be done through the Keycloak Admin Console by navigating to the relevant settings and toggling the feature off.
Conclusion
The Keycloak Admin API vulnerability (CVE-2026-2366) poses a significant risk by allowing unauthorized access to sensitive user information. It is crucial for users to update their packages to the latest versions to mitigate this risk and consider disabling the Organizations feature as a temporary measure.
See every vulnerability recorded for @keycloak/keycloak-admin-client →
FAQ
CVE-2026-2366 is a vulnerability in the Keycloak Admin API that allows unauthorized users to access organization memberships of other users.
Any authenticated user of Keycloak with access to the Admin API can potentially exploit this vulnerability if the Organizations feature is enabled.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability.
If immediate updates are not possible, consider disabling the Organizations feature as a temporary workaround to mitigate the risk.
The CVSS score for this vulnerability is 3.1, indicating a low severity level.
