medium5.5
CVE-2026-18201
Keycloak provides a way to manage identity providers and organizations through its administrative API.
Impact
Keycloak provides a way to manage identity providers and organizations through its administrative API. A flaw was discovered where an administrator with permission to manage identity providers could link a new provider to an organization without having the required permissions to manage that organization. This could allow an unauthorized administrator to influence how users log into specific organizations.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Redhat | Build Of Keycloak | All versions |