Vulnerability · Published Dec 16, 2025 · Assigned by redhat

CVE-2025-14777Keycloak: keycloak idor in realm client creating/deleting

Medium 6.0

In plain English

A medium-severity security flaw in Red Hat build of Keycloak 26.4 from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 28% of all known vulnerabilities).

Severity (CVSS 3.1)6.0Medium

Exploit odds (30 days)0.3%top 71.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A flaw was found in Keycloak. An IDOR (Broken Access Control) vulnerability exists in the admin API endpoints for authorization resource management, specifically in ResourceSetService and PermissionTicketService. The system checks authorization against the resourceServer (client) ID provided in the API request, but the backend database lookup and modification operations (findById, delete) only use the resourceId. This mismatch allows an authenticated attacker with fine-grained admin permissions for one client (e.g., Client A) to delete or update resources belonging to another client (Client B) within the same realm by supplying a valid resource ID.

Affected products (as reported)

Vendor	Product	Versions
Red Hat	Red Hat build of Keycloak 26.4	see references
Red Hat	Red Hat build of Keycloak 26.4	see references
Red Hat	Red Hat build of Keycloak 26.4	see references
Red Hat	Red Hat build of Keycloak 26.4.11	see references

Weakness: CWE-289 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:L

References

RHSA-2026:6477 vendor-advisory, x_refsource_REDHAT
RHSA-2026:6478 vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/security/cve/CVE-2025-14777 vdb-entry, x_refsource_REDHAT
RHBZ#2422596 issue-tracking, x_refsource_REDHAT