CVE-2026-9791: Keycloak Vulnerable to Incorrect Authorization
Summary
CVE-2026-9791: Keycloak Vulnerable to Incorrect Authorization. Affects org.keycloak:keycloak-server-spi-private across 2 version ranges.
< 26.4.7
>= 26.5.0, < 26.6.3
Fixed in 26.4.7 or 26.6.3, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Keycloak is an open-source identity and access management solution that allows organizations to secure applications and services with little to no code. It provides features such as single sign-on (SSO), identity brokering, and user federation. This vulnerability affects Keycloak's ability to enforce proper authorization, potentially allowing unauthorized access to sensitive information.
Vulnerability Detail
A flaw was found in Keycloak where an authenticated user with existing organization membership can exploit this vulnerability by accessing user-facing APIs, such as the account API or by requesting an OpenID Connect (OIDC) token with the 'organization' scope. This flaw allows organization metadata to be disclosed in tokens, even after an administrator has explicitly disabled the Organizations feature. This could lead to incorrect authorization decisions by resource servers, compromising the security of the application.
How To Fix
Latest published version: 26.8.1 as of 23 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 26.4.726.4.7 -
>= 26.5.0, < 26.6.326.6.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, administrators can restrict access to sensitive APIs and ensure that the Organizations feature is disabled until the patch is applied. Additionally, review and limit the permissions granted to authenticated users to minimize the risk of unauthorized access.
Conclusion
The vulnerability CVE-2026-9791 in Keycloak poses a risk of incorrect authorization due to the exposure of organization metadata. It is crucial for users to update their Keycloak installations to the patched versions to mitigate this risk and ensure the security of their applications.
See every vulnerability recorded for org.keycloak:keycloak-server-spi-private →
FAQ
CVE-2026-9791 is a vulnerability in Keycloak that allows authenticated users to access sensitive organization metadata, potentially leading to incorrect authorization decisions.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit the Vulert playground at Vulert Scanner to check if your application is affected without requiring signup.
The vulnerability can lead to unauthorized access to sensitive organization metadata, which may compromise the security of applications relying on Keycloak for authorization.
Update the affected packages to version 26.6.3 using Maven by modifying your pom.xml file with the provided dependency information.
The CVSS score for this vulnerability is 4.3, indicating a moderate level of severity.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.keycloak:keycloak-server-spi-private.
