A flaw was found in Keycloak. A significant Broken Access Control vulnerability exists in the UserManagedPermissionService (UMA Protection API). When updating or deleting a UMA policy associated with multiple resources, the authorization check only verifies the caller's ownership against the first resource in the policy's list. This allows a user (Owner A) who owns one resource (RA) to update a shared policy and modify authorization rules for other resources (e.g., RB) in that same policy, even if those other resources are owned by a different user (Owner B). This constitutes a horizontal privilege escalation.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - A flaw was found in Keycloak. A significant Broken Access Control vulnerability exists in the
    UserManagedPermissionService (UMA Protection API). When updating or deleting a UMA policy associated with
    multiple resources, the authorization check only verifies the caller's ownership against the first
    resource in the policy's list. This allows a user (Owner A) who owns one resource (RA) to update a shared
    policy and modify authorization rules for other resources (e.g., RB) in that same policy, even if those
    other resources are owned by a different user (Owner B). This constitutes a horizontal privilege
    escalation. (CVE-2025-14778)

Keycloak versions installed prior to 26.5.3 are affected by multiple vulnerabilities as referenced in the advisory.

  - A flaw in Keycloak where the JSON Web Token (JWT) authorization grant preview feature fails to validate a user's   disabled status during JWT authorization grant processing. When this feature is enabled, disabled user accounts   can still be used to obtain valid JWTs. (CVE-2026-1609)

  - An attacker can exploit this vulnerability by modifying the organization ID and target email within a legitimate   invitation token's JSON Web Token (JWT) payload. This lack of cryptographic signature verification allows the   attacker to successfully self-register into an unauthorized organization, leading to unauthorized   access. (CVE-2026-1529)

  - A vulnerability exists in the jwt-authorization-grant flow where the server fails to verify if an Identity   Provider (IdP) is enabled before issuing tokens. The issuer lookup mechanism (lookupIdentityProviderFromIssuer)   retrieves the IdP configuration but does not filter for isEnabled=false. If an administrator disables an IdP   (e.g., due to a compromise or offboarding), an entity possessing that IdP's signing key can still generate valid   JWT assertions that Keycloak accepts, resulting in the issuance of valid access tokens. (CVE-2026-1486)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
457791	Echo: keycloak-25: security update to 25.0.6+e1org.keycloak:keycloak-services: security update to 26.2.13	Tenable Cloud Security	Echo Local Security Checks	Local	medium
457791	Echo: keycloak-25: security update to 25.0.6+e1org.keycloak:keycloak-services: security update to 26.2.13	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	medium
298654	Keycloak < 26.5.3 Multiple Vulnerabilities	Nessus	Misc.	Local	high
437679	SCA: security update for org.keycloak:keycloak-services (GHSA-fm6w-rrp3-2x4w)	Tenable Cloud Security	SCA Checks	Local	medium
437679	SCA: security update for org.keycloak:keycloak-services (GHSA-fm6w-rrp3-2x4w)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium

Detections

Analytics

CVE-2025-14778

medium

Tenable Plugins

medium

medium

high

medium

medium