CVE-2026-9791

MEDIUM 4.3

Keycloak-rhel9: organization data leak after feature disabled in keycloak

CVSS Score

4.3

EPSS Score

0.0%

EPSS Percentile

0th

A flaw was found in Keycloak. An authenticated user with existing organization membership can exploit this flaw by accessing user-facing APIs, such as the account API or by requesting an OpenID Connect (OIDC) token with the 'organization' scope. This allows organization metadata to be disclosed in tokens, even after an administrator has explicitly disabled the Organizations feature, potentially leading to incorrect authorization decisions by resource servers.

CWE	CWE-863
Vendor	red hat
Product	red hat build of keycloak
Published	May 28, 2026
Last Updated	May 28, 2026

Stay Ahead of the Next One

Get instant alerts for red hat red hat build of keycloak

Be the first to know when new medium vulnerabilities affecting red hat red hat build of keycloak are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Affected Versions

Red Hat / Red Hat Build of Keycloak

All versions affected

References

NVD ↗ CVE.org ↗ EPSS Data ↗

access.redhat.com: https://access.redhat.com/security/cve/CVE-2026-9791 bugzilla.redhat.com: https://bugzilla.redhat.com/show_bug.cgi?id=2482458

Credits

Red Hat would like to thank Evan Hendra (Independent Security Researcher) for reporting this issue.