Insecure Direct Object Reference Vulnerability in Keycloak by Red Hat

CVE-2026-4630

What is CVE-2026-4630?

A vulnerability in Keycloak allows an authenticated client to exploit an Insecure Direct Object Reference (IDOR) in the Authorization Services Protection API endpoint. By leveraging knowledge of another Resource Server's unique identifier (UUID) within the same realm, the client can circumvent authorization checks. This exploitation enables unauthorized GET, PUT, and DELETE operations on resources, which may result in unauthorized access to sensitive information and potential modification or deletion of data.

References