Vulnerability in Red Hat Build of Keycloak

[ Description ]Official description

A flaw was found in the user update mechanism of the Keycloak Admin REST API. When Fine-Grained Admin Permissions are enabled, the system fails to check for specific password reset authorizations during a general user profile update. This allows a delegated administrator, who should be restricted from resetting passwords, to change a user's credentials and take over their account.

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ Advisories ]Government CERT advisories

• BSI CERT-Bund23 Sep 2026WID-SEC-2026-3558

  Keycloak: Multiple vulnerabilities Translated from German

  CVE-2026-97176CVE-2026-96445CVE-2026-97177+1 more CVEs

[ References ]References

• access.redhat.com/security/cve/CVE-2026-97177
• bugzilla.redhat.com/show_bug.cgi