PT-2026-36114 · Red Hat · Keycloak

Evan Hendra · Published 2026-04-30 · Updated 2026-06-10 · CVE-2026-7500

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Keycloak (affected versions not specified)

Description When the software is started with the --features-disabled=account,account-api flag, the Account REST API is only partially disabled. Five endpoints under the versioned path "/account/v1alpha1" remain fully functional for both read and write operations. This occurs because these endpoints lack the checkAccountApiEnabled() function gate that is used to block other endpoints within the same REST service class. Access to these endpoints still requires the user to have the necessary permissions to use the API.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-425

Related Identifiers

CVE-2026-7500

GHSA-HM32-HFMW-RHVG

Affected Products

Keycloak

References · 11

• https://access.redhat.com/errata/RHSA-2026:25098 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-hm32-hfmw-rhvg · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2026:25097 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-7500 · Security Note
• https://access.redhat.com/security/cve/CVE-2026-7500 · Vendor Advisory
• https://github.com/keycloak/keycloak · Note
• https://github.com/keycloak/keycloak/pull/48715 · Note
• https://github.com/keycloak/keycloak/issues/48709 · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=2464126 · Note
• https://t.me/CVEtracker/52325 · Telegram Post
• https://t.me/cveNotify/166955 · Telegram Post