Flaw in Identity Provider Mapper of Keycloak Allows Unauthorized Administrative Access
CVE-2026-12388

6.5MEDIUM

Key Information:

Vendor

Red Hat
Status
Red Hat Build Of Keycloak
Vendor
CVE Published:
30 June 2026

What is CVE-2026-12388?

A critical flaw exists in the Identity Provider (IdP) mapper component of Keycloak, which manages the mapping of user information from external services to Keycloak users. This vulnerability enables an administrator with limited permissions to exploit the 'Hardcoded Role' mapper feature, granting themselves or other users elevated administrative roles, such as realm-admin. As a result, unauthorized administrators can circumvent security checks, potentially gaining complete control over the entire realm, posing significant security risks to user data and application integrity.

References

https://access.redhat.com/security/cve/CVE-2026-12388
vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2489140
issue-trackingx_refsource_REDHAT

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.