PT-2026-3762 · Red Hat · Keycloak

Published 2026-01-21 · Updated 2026-01-21 · CVE-2025-14083

Positive Technologies (AI Summary)

CVSS v3.1

2.7

Low

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Keycloak (affected versions not specified)

Description A flaw exists in the Keycloak Admin REST API. This issue allows exposure of backend schema and rules, which could lead to targeted attacks or privilege escalation due to improper access control. The vulnerability affects the Admin REST API.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

LPE

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2025-14083

GHSA-594W-2FWP-JWRC

Affected Products

Keycloak

References · 12

• https://access.redhat.com/errata/RHSA-2026:6478 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-594w-2fwp-jwrc · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2026:6477 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-14083 · Security Note
• https://github.com/keycloak/keycloak · Note
• https://github.com/keycloak/keycloak/issues/45493 · Note
• https://access.redhat.com/security/cve/CVE-2025-14083 · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=2419086 · Note
• https://t.me/CVEtracker/42657 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2013969470595760150 · Twitter Post
• https://twitter.com/CVEnew/status/2013976722601865306 · Twitter Post
• https://t.me/cveNotify/149377 · Telegram Post