Auth bypass in Red Hat Build Of Keycloak

CVE-2026-18201

Keycloak provides a way to manage identity providers and organizations through its administrative API. A flaw was discovered where an administrator with permission to manage identity providers could link a new provider to an organization without having the required permissions to manage that organization. This could allow an unauthorized administrator to influence how users log into specific organizations.

Vulnerability class: Broken Access Control

EPSS: 0.002 (12.1th percentile) — read the EPSS interpretation.