CVE-2025-13881 Keycloak Admin API allows an administrator with limited privileges to retrieve sensitive custom attributes
Limited administrators can bypass visibility settings to retrieve sensitive user attributes via the Keycloak Admin API.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-13881?
CVE-2025-13881 is a low-severity missing authorization vulnerability in Red Hat build of Keycloak 26.4, published on 2 Feb 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
A flaw was found in Keycloak Admin API. This vulnerability allows an administrator with limited privileges to retrieve sensitive custom attributes via the /unmanagedAttributes endpoint, bypassing User Profile visibility settings.
Weakness: CWE-266
Which versions are affected by CVE-2025-13881?
4 open source packages ship an affected version, including org.keycloak:keycloak-services.
| Package | Affected | Fixed in |
|---|---|---|
org.keycloak:keycloak-services Maven | All versions | 26.4.9 |
org.keycloak:keycloak-services Maven | All versions | 26.4.9 |
org.keycloak:keycloak-services Maven | From 26.5.0 | 26.5.2 |
org.keycloak:keycloak-services Maven | From 26.5.0 | 26.5.2 |
How do I fix CVE-2025-13881?
Upgrade org.keycloak:keycloak-services to a fixed version for your release line: 26.4.9 or 26.5.2.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2025-13881 being exploited?
There is no known exploitation of CVE-2025-13881 in the wild and no public exploit code.
Sources
Also known as ECHO-c931-21d1-485c, GHSA-g78x-7vwx-9f58, MINI-826c-r92r-r4gp, MINI-wrmc-jjq4-gcrg.