CVE-2025-13881Keycloak Admin API auth bypass to custom attributes
What broke
The Keycloak Admin API did not enforce the intended permission on sensitive custom user attributes (CWE-266, incorrect privilege assignment). A lesser admin or a token with a narrower role could read them. Red Hat patched.
Why it matters
Custom attributes are where people hide government IDs, recovery emails, and internal employee numbers. An Admin API authz gap is a privacy incident and a recovery-channel takeover in one.
What to do
- Upgrade Keycloak.
- Audit who can call the Admin API. Service accounts with
realm-managementare the usual over-grant. - Stop putting secrets in user attributes. Use a vault.
After you patch
Patching closes the entry point. It does not remove access an attacker established through it.
- Revoke sessions and API tokens on the affected system rather than only resetting passwords.
- Audit accounts, tokens, and administrative changes made during the exposure window.
- Rotate credentials the system stored or could reach, including directory service accounts and integration keys. See secrets rotation.
- Treat the system as a pivot: whatever it could authenticate to is in scope until you have checked it.
Sources
Related identity CVEs
Related on Start with Identity
- CVEKeycloak accepts SAML from a disabled identity provider
A remote attacker can complete a broker login with a valid SAML response even after the SAML IdP is disabled in Keycloak. Unauthorized authentication via a cont
- CVEKeycloak authorization bypass
Keycloak failed an authorization check, so a caller could reach a resource their role should have blocked. Part of the April 2024 RHSA-2024:1868 set with CVE-20
- CVEKeycloak client policy enforcement flaw
A 2026 Keycloak client-policy enforcement bug. Client policies are how you ban implicit flow, require PKCE, or force FAPI. If they do not fire, the realm's writ
- BlogA CVE ID is a name. The value is knowing who the attacker becomes.
We opened a practitioner catalog of identity CVEs: what broke, why IAM teams should care, and what to do this week. Not an NVD mirror. A place to triage SAML wr
- Comparisonfusionauth-vs-keycloak
FusionAuth and Keycloak are the two names that dominate the self-hosted identity conversation, but they sit on opposite sides of the open-source line. Keycloak
- VendorKeycloak
strong