PT-2026-44182 · Red Hat · Keycloak

Evan Hendra · CVE-2026-9791 · Published 2026-05-28 · Updated 2026-06-26

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Keycloak (affected versions not specified)

Description An authenticated user with existing organization membership can exploit a flaw by accessing user-facing APIs, such as the account API, or by requesting an OpenID Connect (OIDC) token with the organization scope. This results in the disclosure of organization metadata in tokens, even if an administrator has explicitly disabled the Organizations feature. This leak may lead to incorrect authorization decisions by resource servers.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2026-9791

GHSA-4Q93-V92X-P89F

Affected Products

Keycloak

References · 22

• https://access.redhat.com/errata/RHSA-2026:25098 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2026:30050 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2026:30049 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2026:25097 · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=2482458 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-9791 · Security Note
• https://access.redhat.com/security/cve/CVE-2026-9791 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-4q93-v92x-p89f · Vendor Advisory
• https://github.com/keycloak/keycloak/pull/49680 · Note
• https://github.com/keycloak/keycloak/pull/49541 · Note
• https://github.com/keycloak/keycloak/pull/49678 · Note
• https://github.com/keycloak/keycloak/commit/0e706e7c83d1e971b48656ad9e674eec6adc225b · Note
• https://github.com/keycloak/keycloak/issues/49431 · Note
• https://github.com/keycloak/keycloak/commit/f19e1f2b4e998116d4e321f50ecf99c0f87b862f · Note
• https://github.com/keycloak/keycloak/commit/a77c60f2f3e0793046add44120579871e92553df · Note