medium6.5
CVE-2026-4629
A flaw was found in Keycloak.
Impact
A flaw was found in Keycloak. A highly privileged user with `manage-clients` permission can exploit this vulnerability by injecting a hardcoded role mapper into any client. This action allows the user to bypass existing scope restrictions and inject the `realm-admin` role into generated tokens, resulting in privilege escalation and full administrative access to the realm.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Redhat | Build Of Keycloak | All versions |