CVE-2025-13881

LOW 2.7

Org.keycloak.services.resources.admin: keycloak: limited administrator can retrieve sensitive user attributes via admin api

CVSS Score

2.7

EPSS Score

0.0%

EPSS Percentile

0th

A flaw was found in Keycloak Admin API. This vulnerability allows an administrator with limited privileges to retrieve sensitive custom attributes via the /unmanagedAttributes endpoint, bypassing User Profile visibility settings.

CWE	CWE-266
Vendor	red hat
Product	red hat build of keycloak 26.4
Published	Feb 2, 2026
Last Updated	Feb 10, 2026

Stay Ahead of the Next One

Get instant alerts for red hat red hat build of keycloak 26.4

Be the first to know when new low vulnerabilities affecting red hat red hat build of keycloak 26.4 are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Affected Versions

Red Hat / Red Hat build of Keycloak 26.4

All versions affected

Red Hat / Red Hat build of Keycloak 26.4

All versions affected

Red Hat / Red Hat build of Keycloak 26.4

All versions affected

Red Hat / Red Hat build of Keycloak 26.4.9

All versions affected

References

NVD ↗ CVE.org ↗ EPSS Data ↗

access.redhat.com: https://access.redhat.com/errata/RHSA-2026:2365 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:2366 access.redhat.com: https://access.redhat.com/security/cve/CVE-2025-13881 bugzilla.redhat.com: https://bugzilla.redhat.com/show_bug.cgi?id=2418330

Credits

Red Hat would like to thank Simone Paganessi for reporting this issue.