Incorrect authorization in keycloak REST API
Priority LOW 34CWE-863Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- High
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Partial Red Hat: 6 fixed, 4 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-863.
Summary
A flaw was found in the Keycloak REST API before version 8.0.0 where it would permit user access from a realm the user was not configured. An authenticated attacker with knowledge of a user id could use this flaw to access unauthorized information or to carry out further attacks.
Why it matters now
EPSS 0.0054 45th percentileScored 2026-11-07
Fix Partial org.keycloak:keycloak-model-infinispan (Maven): 7.0.1org.keycloak:keycloak-model-jpa (Maven): 7.0.1Red Hat: 6 advisoriesRed Hat: 6 fixed, 4 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Keycloak | keycloak REST API | before version 8.0.0; fixed in 8.0.0 | — | No fix listed | CNA |
| — | org.keycloak:keycloak-model-infinispan (Maven) | before 7.0.1 | 7.0.1 | Patch available | GHSA-8prc-58j4-m55q |
| — | org.keycloak:keycloak-model-jpa (Maven) | before 7.0.1 | 7.0.1 | Patch available | GHSA-8prc-58j4-m55q |
- keycloak REST API VendorKeycloak Affected before version 8.0.0; fixed in 8.0.0 Fixed in — No fix listed CNA
- org.keycloak:keycloak-model-infinispan (Maven) Vendor— Affected before 7.0.1 Fixed in 7.0.1 Patch available GHSA-8prc-58j4-m55q
- org.keycloak:keycloak-model-jpa (Maven) Vendor— Affected before 7.0.1 Fixed in 7.0.1 Patch available GHSA-8prc-58j4-m55q
Remediation
- Fix · GHSA-8prc-58j4-m55q org.keycloak:keycloak-model-infinispan (Maven) Fixed in 7.0.1 Advisory →
- Fix · GHSA-8prc-58j4-m55q org.keycloak:keycloak-model-jpa (Maven) Fixed in 7.0.1 Advisory →
Red Hat 6 advisories
- RHSA-2020:2366 Released 2020-06-04 · Red Hat rating ImportantRed Hat support for Spring Boot 2.1.12 security and bug fix update
- Red Hat Runtimes Spring Boot 2.1.12
- RHSA-2020:2067 Released 2020-05-18 · Red Hat rating ImportantRed Hat build of Thorntail 2.5.1 security and bug fix update
- Text-Only RHOAR
- RHSA-2019:3046 Released 2019-10-14 · Red Hat rating ImportantRed Hat Single Sign-On 7.3.4 security update on RHEL 8
- Red Hat Single Sign-On 7.3 for RHEL 8 rh-sso7-keycloak-4.8.13-1.Final_redhat_00001.1.el8sso, rh-sso7-keycloak-server-4.8.13-1.Final_redhat_00001.1.el8sso
Show 3 more Red Hat advisories
- RHSA-2019:3050 Released 2019-10-14 · Red Hat rating ImportantRed Hat Single Sign-On 7.3.4 security update
- Red Hat Single Sign-On 7.3.4 zip
- RHSA-2019:3045 Released 2019-10-14 · Red Hat rating ImportantRed Hat Single Sign-On 7.3.4 security update on RHEL 7
- Red Hat Single Sign-On 7.3 for RHEL 7 Server rh-sso7-keycloak-4.8.13-1.Final_redhat_00001.1.el7sso, rh-sso7-keycloak-server-4.8.13-1.Final_redhat_00001.1.el7sso, rh-sso7-libunix-dbus-java-0.8.0-2.el7sso +1
- RHSA-2019:3044 Released 2019-10-14 · Red Hat rating ImportantRed Hat Single Sign-On 7.3.4 security update on RHEL 6
- Red Hat Single Sign-On 7.3 for RHEL 6 Server rh-sso7-keycloak-4.8.13-1.Final_redhat_00001.1.el6sso, rh-sso7-keycloak-server-4.8.13-1.Final_redhat_00001.1.el6sso
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Fuse 7 | Affected | No fix planned: Will not fix |
| Red Hat Mobile Application Platform 4 | Affected | No fix planned: Out of support scope |
| Red Hat OpenShift Application Runtimes | Affected | No fix planned: Out of support scope |
| Red Hat support for Spring Boot | Affected | No fix yet |
| Red Hat Runtimes Spring Boot 2.1.12 | Fixed | RHSA-2020:2366 |
| Red Hat Single Sign-On 7.3 for RHEL 6 Server | Fixed | RHSA-2019:3044 |
| Red Hat Single Sign-On 7.3 for RHEL 7 Server | Fixed | RHSA-2019:3045 |
| Red Hat Single Sign-On 7.3 for RHEL 8 | Fixed | RHSA-2019:3046 |
| Red Hat Single Sign-On 7.3.4 zip | Fixed | RHSA-2019:3050 |
| Text-Only RHOAR | Fixed | RHSA-2020:2067 |
Timeline
- 2026-10-02 Threatist record created from CVE-2019-14832
- 2026-10-03 Alias added: GHSA-8prc-58j4-m55q
References
More Keycloak vulnerabilities
- TI-2022-03994 Cross-site scripting in keycloak CVSS 3.1CRITICAL 10.0
- TI-2017-05120 It was found that the Keycloak Node.js adapter 2.5 - 3.0 did not handle invalid tokens… CVSS 3.0CRITICAL 9.8
- TI-2017-08952 Weak password recovery in Red Hat Keycloak CVSS 3.0HIGH 8.8
- TI-2014-03024 The org.keycloak.services.resources.SocialResource.callback method in JBoss KeyCloak… CVSS 3.0HIGH 8.8
- TI-2026-01295 Org.keycloak/keycloak-quarkus-server: keycloak: unauthorized access via jwt authorization grant with disabled users CVSS 3.1HIGH 8.1
- TI-2017-08950 Insufficient session expiration in Red Hat keycloak CVSS 3.0HIGH 7.5
Sources
- CVE-2019-14832 · CVE Program
- CVE-2019-14832 · NVD
- FIRST EPSS
- GHSA-8prc-58j4-m55q · GitHub Advisory Database · CC BY 4.0
- CVE-2019-14832 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences