Authorization Flaw in Keycloak User-Managed Access Implementation
CVE-2026-94217

3.5LOW

Key Information:

Vendor

Red Hat
Status
Red Hat Build Of Keycloak
Red Hat Single Sign-on 7
Vendor
CVE Published:
21 September 2026

What is CVE-2026-94217?

An authorization flaw presents itself within the User-Managed Access (UMA) implementation of Keycloak, specifically at the authorization token endpoint. This issue arises when permission tickets are processed, particularly when different users possess resources with identical names. In such cases, the system erroneously merges permissions, allowing an attacker to gain unauthorized access to resources intended solely for other users. This vulnerability underscores the importance of proper access controls in resource sharing applications.

References

https://access.redhat.com/security/cve/CVE-2026-94217
vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2537313
issue-trackingx_refsource_REDHAT

CVSS V3.1

Score:
3.5
Severity:
LOW
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.