CVE-2026-3911: Keycloak Services Information Disclosure Vulnerability
Summary
CVE-2026-3911: Keycloak: Information disclosure of disabled user attributes via administrative endpoint. Affects org.keycloak:keycloak-services versions < 26.5.5. No fix is published. How to fix ↓
Also tracked for
- keycloak · Bitnami
The same CVE-2026-3911 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Keycloak is an open-source identity and access management solution designed for modern applications and services. It provides features such as single sign-on, user federation, identity brokering, and social login. The Keycloak services package, specifically 'org.keycloak:keycloak-services', is responsible for managing user data and authentication processes. However, it has been identified to have a vulnerability that allows unauthorized access to sensitive user attributes.
Vulnerability Detail
A flaw exists in the UserResource component of Keycloak, where an authenticated user with the 'view-users' role can exploit a vulnerability by accessing a specific administrative endpoint. This allows the user to improperly retrieve user attributes that are configured to be hidden, leading to unauthorized information disclosure. The potential ramifications include exposure of sensitive user data, which could compromise user privacy and security.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, administrators can restrict access to the administrative endpoint to only trusted users or roles until the package is updated. This can be done by modifying the security settings in Keycloak to limit who can access user attributes.
Conclusion
In summary, CVE-2026-3911 is a vulnerability in Keycloak that allows unauthorized information disclosure of hidden user attributes. It is crucial for users to update to the patched version to mitigate risks associated with this vulnerability. Additionally, utilizing tools like Vulert can help in monitoring and managing open-source vulnerabilities effectively.
See every vulnerability recorded for org.keycloak:keycloak-services →
FAQ
The CVSS score of this vulnerability is 2.7, indicating a low severity level.
Any authenticated user with the 'view-users' role in Keycloak versions up to 26.5.5 is affected by this vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The potential risks include unauthorized access to sensitive user data, which could lead to privacy breaches and security issues.
Yes, Vulert provides a service that monitors and alerts for open-source vulnerabilities in your software using just the pom.xml file.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.keycloak:keycloak-services.
