CVE-2025-14083 Keycloak-server: keycloak: improper access control in admin rest api leads to information disclosure
Improper access control in Keycloak Admin REST API exposes backend schema and rules, enabling information disclosure and potential privilege escalation.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-14083?
CVE-2025-14083 is a low-severity vulnerability in Red Hat build of Keycloak 26.4, published on 21 Jan 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
A flaw was found in the Keycloak Admin REST API. This vulnerability allows the exposure of backend schema and rules, potentially leading to targeted attacks or privilege escalation via improper access control.
Weakness: CWE-284
Which versions are affected by CVE-2025-14083?
2 open source packages ship an affected version, including org.keycloak:keycloak-services.
| Package | Affected | Fixed in |
|---|---|---|
org.keycloak:keycloak-services Maven | All versions to 26.2.5 | None |
org.keycloak:keycloak-services Maven | All versions to 26.2.5 | None |
How do I fix CVE-2025-14083?
Upgrade to a fixed version.
Is CVE-2025-14083 being exploited?
There is no known exploitation of CVE-2025-14083 in the wild and no public exploit code.
Sources
Also known as GHSA-594w-2fwp-jwrc, MINI-h2xr-jpqj-f92c.