PT-2026-44182 · Red Hat · Red Hat Build Of Keycloak

Published 2026-05-28 · Updated 2026-05-28 · CVE-2026-9791

NVD

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

A flaw was found in Keycloak. An authenticated user with existing organization membership can exploit this flaw by accessing user-facing APIs, such as the account API or by requesting an OpenID Connect (OIDC) token with the 'organization' scope. This allows organization metadata to be disclosed in tokens, even after an administrator has explicitly disabled the Organizations feature, potentially leading to incorrect authorization decisions by resource servers.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2026-9791

Affected Products

Red Hat Build Of Keycloak

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-9791 · Security Note
• https://access.redhat.com/security/cve/CVE-2026-9791 · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=2482458 · Note