Keycloak Admin API Allows Identity Provider Linking Without Org Admin Privileges
CVE-2026-18201 Published on July 29, 2026
Keycloak-services: keycloak-services: generic identity-provider creation can bind brokers to organizations without manage-organizations
Keycloak provides a way to manage identity providers and organizations through its administrative API. A flaw was discovered where an administrator with permission to manage identity providers could link a new provider to an organization without having the required permissions to manage that organization. This could allow an unauthorized administrator to influence how users log into specific organizations.
Vulnerability Analysis
CVE-2026-18201 can be exploited with network access, and requires user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have a small impact on confidentiality, a high impact on integrity, and no impact on availability.
Timeline
Reported to Red Hat.
Made public.
Weakness Type
What is an AuthZ Vulnerability?
The software does not perform an authorization check when an actor attempts to access a resource or perform an action.
CVE-2026-18201 has been classified to as an AuthZ vulnerability or weakness.
Products Associated with CVE-2026-18201
Want to know whenever a new CVE is published for Red Hat products? stack.watch will email you.
