CVE-2026-18201 — Keycloak-services: keycloak-services: generic identity-provider creation can bind brokers to organizations without manage-organizations
Keycloak provides a way to manage identity providers and organizations through its administrative API. A flaw was discovered where an administrator with permission to manage ide…
Published: 2026-07-29 · CVSS: 5.5 · CVSS 3.1
Keycloak provides a way to manage identity providers and organizations through its administrative API. A flaw was discovered where an administrator with permission to manage identity providers could link a new provider to an organization without having the required permissions to manage that organization. This could allow an unauthorized administrator to influence how users log into specific organizations.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7