Read the docs
TI-2016-07091 Aliases CVE-2016-8629GHSA-778x-2mqv-w6xw

Improper access control in Red Hat Keycloak

Priority LOW 33CWE-284Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
None · High · None
Fix status
Fixed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-284.

Summary

Red Hat Keycloak before version 2.4.0 did not correctly check permissions when handling service account user deletion requests sent to the rest server. An attacker with service account authentication could use this flaw to bypass normal permissions and delete users in a separate realm.

Why it matters now

EPSS 0.01901 79th percentileScored 2026-11-07
Fix Fixed org.keycloak:keycloak-core (Maven): 2.4.0Red Hat: 3 advisories

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
Red HatKeycloak2.4.0—No fix listedCNA
—org.keycloak:keycloak-core (Maven)before 2.4.02.4.0Patch availableGHSA-778x-2mqv-w6xw
  • Keycloak VendorRed Hat Affected 2.4.0 Fixed in — No fix listed CNA
  • org.keycloak:keycloak-core (Maven) Vendor— Affected before 2.4.0 Fixed in 2.4.0 Patch available GHSA-778x-2mqv-w6xw

CPE configurations NVD · 5

CPEVersionsRoleVendor
cpe:2.3:a:redhat:keycloak:*:*:*:*:*:*:*:*before 2.4.0VulnerableRed Hat
cpe:2.3:a:redhat:single_sign_on:7.1:*:*:*:*:*:*:*7.1VulnerableRed Hat
cpe:2.3:a:redhat:single_sign_on:7.2:*:*:*:*:*:*:*7.2VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*6.0Running onRed Hat
cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*7.0Running onRed Hat
  • cpe:2.3:a:redhat:keycloak:*:*:*:*:*:*:*:* Versions before 2.4.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:single_sign_on:7.1:*:*:*:*:*:*:* Versions 7.1 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:single_sign_on:7.2:*:*:*:*:*:*:* Versions 7.2 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:* Versions 6.0 Running on ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:* Versions 7.0 Running on ·Red Hat

Remediation

  • Fix · GHSA-778x-2mqv-w6xw org.keycloak:keycloak-core (Maven) Fixed in 2.4.0 Advisory →

Red Hat 3 advisories

  • RHSA-2017:0872 Released 2017-04-04 · Red Hat rating Moderate
    Red Hat Single Sign-On 7.1 update on RHEL 6
    • Red Hat Single Sign-On 7.1 for RHEL 6 Server rh-sso7-1-2.jbcs.el6, rh-sso7-freemarker-2.3.23-1.redhat_2.2.jbcs.el6, rh-sso7-javapackages-tools-3.4.1-5.15.3.jbcs.el6 +13
  • RHSA-2017:0873 Released 2017-04-04 · Red Hat rating Moderate
    Red Hat Single Sign-On 7.1 update on RHEL 7
    • Red Hat Single Sign-On 7.1 for RHEL 7 Server rh-sso7-1-2.jbcs.el7, rh-sso7-freemarker-2.3.23-1.redhat_2.2.jbcs.el7, rh-sso7-javapackages-tools-3.4.1-5.15.3.jbcs.el7 +13
  • RHSA-2017:0876 Released 2017-04-04 · Red Hat rating Moderate
    Red Hat Single Sign-On 7.1 update
    • Red Hat Single Sign-On 7.1

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    Red Hat Keycloak — RHSA-2017:0876

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    • TI-2017-01840 Information disclosure in Red Hat keycloakPriority LOW 30
    Show all 2 records → Advisory →
  • Advisory ·

    Red Hat Keycloak — RHSA-2017:0872

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    • TI-2017-01840 Information disclosure in Red Hat keycloakPriority LOW 30
    Show all 2 records → Advisory →
Show 1 more group
  • Advisory ·

    Red Hat Keycloak — RHSA-2017:0873

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    • TI-2017-01840 Information disclosure in Red Hat keycloakPriority LOW 30
    Show all 2 records → Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Single Sign-On 7.1Fixed RHSA-2017:0876
Red Hat Single Sign-On 7.1 for RHEL 6 ServerFixed RHSA-2017:0872
Red Hat Single Sign-On 7.1 for RHEL 7 ServerFixed RHSA-2017:0873

Timeline

  1. 2026-10-02 Threatist record created from CVE-2016-8629
  2. 2026-10-03 Alias added: GHSA-778x-2mqv-w6xw

References

Advisory 5

Other 1

  • TI-2024-01049 Keycloak: path transversal in redirection validation CVSS 3.1HIGH 8.1
  • TI-2023-26623 The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6… CVSS 3.1MEDIUM 5.9
  • TI-2020-08665 Server-side request forgery in keycloak CVSS 3.1MEDIUM 5.3
  • TI-2022-03468 Path traversal in Red Hat Keycloak CVSS 3.1CRITICAL 9.1
  • TI-2021-03612 A POST based reflected Cross Site Scripting vulnerability on has been identified in Keycloak. CVSS 3.1MEDIUM 6.1
  • TI-2022-03994 Cross-site scripting in keycloak CVSS 3.1CRITICAL 10.0
See all 97 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences