CVE-2025-14082 Keycloak Admin REST (Representational State Transfer) API does not properly enforce permissions
Attackers can access sensitive role metadata via the Keycloak Admin REST API due to insufficient authorization checks on the roles endpoint.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-14082?
CVE-2025-14082 is a low-severity missing authorization vulnerability in Red Hat build of Keycloak 26.4, published on 10 Dec 2025. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
A flaw was found in Keycloak Admin REST (Representational State Transfer) API. This vulnerability allows information disclosure of sensitive role metadata via insufficient authorization checks on the /admin/realms/{realm}/roles endpoint.
Weakness: CWE-284
Which versions are affected by CVE-2025-14082?
2 open source packages ship an affected version, including org.keycloak:keycloak-services.
| Package | Affected | Fixed in |
|---|---|---|
org.keycloak:keycloak-services Maven | All versions | 26.5.0 |
org.keycloak:keycloak-services Maven | All versions | 26.5.0 |
How do I fix CVE-2025-14082?
Upgrade org.keycloak:keycloak-services to 26.5.0 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2025-14082 being exploited?
There is no known exploitation of CVE-2025-14082 in the wild and no public exploit code.
Sources
Also known as ECHO-be84-7958-aebf, GHSA-6q37-7866-h27j, MINI-whpc-9x62-jvq7, MINI-x3gf-p923-j9px.