A flaw was found in Keycloak. An authenticated user with existing organization membership can exploit this flaw by accessing user-facing APIs, such as the account API or by requesting an OpenID Connect (OIDC) token with the 'organization' scope. This allows organization metadata to be disclosed in tokens, even after an administrator has explicitly disabled the Organizations feature, potentially leading to incorrect authorization decisions by resource servers.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - A flaw was found in Keycloak. An authenticated user with existing organization membership can exploit this
    flaw by accessing user-facing APIs, such as the account API or by requesting an OpenID Connect (OIDC)
    token with the 'organization' scope. This allows organization metadata to be disclosed in tokens, even
    after an administrator has explicitly disabled the Organizations feature, potentially leading to incorrect
    authorization decisions by resource servers. (CVE-2026-9791)

ID	Name	Product	Family	Type	Severity
459501	Echo: keycloak-25: security update to 25.0.6+e1org.keycloak:keycloak-server-spi-private: security update to 26.6.3	Tenable Cloud Security	Echo Local Security Checks	Local	medium
459501	Echo: keycloak-25: security update to 25.0.6+e1org.keycloak:keycloak-server-spi-private: security update to 26.6.3	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	medium
444281	SCA: security update for org.keycloak:keycloak-server-spi-private, org.keycloak:keycloak-services (GHSA-4q93-v92x-p89f)	Tenable Cloud Security	SCA Checks	Local	medium
444281	SCA: security update for org.keycloak:keycloak-server-spi-private, org.keycloak:keycloak-services (GHSA-4q93-v92x-p89f)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium

Detections

Analytics

CVE-2026-9791

medium

Tenable Plugins

medium

medium

medium

medium