CVE-2025-13881 — Org.keycloak.services.resources.admin: keycloak: limited administrator can retrieve sensitive user attributes via admin api
A flaw was found in Keycloak Admin API. This vulnerability allows an administrator with limited privileges to retrieve sensitive custom attributes via the /unmanagedAttributes e…
Published: 2026-02-02 · CVSS: 2.7 · CVSS 3.1
A flaw was found in Keycloak Admin API. This vulnerability allows an administrator with limited privileges to retrieve sensitive custom attributes via the /unmanagedAttributes endpoint, bypassing User Profile visibility settings.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7