org.keycloak:keycloak-server-spi-private@26.5.2

org.keycloak:keycloak-server-spi-private is an open source identity and access management solution for modern applications and services.

Affected versions of this package are vulnerable to Information Exposure through the AuthenticationManagementResource in services/src/main/java/org/keycloak/services/resources/admin/AuthenticationManagementResource.java. An attacker can retrieve raw authenticator configuration secrets by requesting authentication config data through the admin API as a user with view-only permissions. The vulnerable GET paths return ModelToRepresentation.toRepresentation(config) without masking sensitive entries, so values such as reCAPTCHA secret keys are exposed in the response and can also appear in administrative logs. This leaks third-party service credentials to unauthorized administrators and can expose secrets used by the realm’s authentication flows.

Notes

• The leak is limited to the admin GET endpoints that return authenticator-config representations, so only deployments where administrators can view authentication configs through the admin API are exposed.
• The exposed values are those stored in authenticator config metadata, including provider-defined secrets and legacy/unknown keys that are not recognized as non-secret by the provider registry.

A fix was pushed into the master branch but not yet published.

org.keycloak:keycloak-server-spi-private is an open source identity and access management solution for modern applications and services.

Affected versions of this package are vulnerable to Insufficient Granularity of Access Control in the group retrieval due to an improper conditional check that fails to apply permission filters when FGAP v2 is enabled. An attacker can access sensitive group metadata and attributes by querying child groups through a parent group endpoint without having the necessary per-child view permissions.

Note: This is only exploitable if the attacker possesses a delegated administrator role with specific permissions.

Upgrade org.keycloak:keycloak-server-spi-private to version 26.7.1 or higher.

org.keycloak:keycloak-server-spi-private is an open source identity and access management solution for modern applications and services.

Affected versions of this package are vulnerable to Insufficient Granularity of Access Control in the getMembers() methods that serve the group members endpoint. An admin user with delegated access to read group memberships and users can read user profile attributes that are explicitly configured to be denied by using their delegated administrative access to expose those values over the group membership API.

Upgrade org.keycloak:keycloak-server-spi-private to version 26.6.3 or higher.

org.keycloak:keycloak-server-spi-private is an open source identity and access management solution for modern applications and services.

Affected versions of this package are vulnerable to Incorrect Authorization via the user-facing APIs when the Organizations feature is disabled. An attacker can access organization membership data and obtain tokens containing organization claims by making authenticated requests, even after an administrator has disabled the feature at the realm level.

Upgrade org.keycloak:keycloak-server-spi-private to version 26.6.3 or higher.

org.keycloak:keycloak-server-spi-private is an open source identity and access management solution for modern applications and services.

Affected versions of this package are vulnerable to Replay Attack through the RequiredActionFactory and required-action implementations in the authentication flow. An attacker can reuse a required-action email token by completing the action and then opening the same link again, causing the same account-management action to be accepted more than once. This lets a stale execute-actions-email link remain valid for repeated use, allowing repeated password updates, TOTP enrollment, account deletion, or other required actions to be triggered from the same token and undermining the intended single-use behavior.

Notes

• The replay issue is not limited to password resets: any required action implemented through RequiredActionFactory and exposed via execute-actions-email inherits the same single-use semantics, including flows such as TOTP enrollment, account deletion, and WebAuthn-related enrollment paths.
• The vulnerable behavior is in the default isOneTimeAction() contract, so deployments that rely on custom required-action providers without their own override can also be affected even if the built-in actions are not the only ones in use.
• While the fix was back-ported to version 26.4.12, this version has not been published to Maven Central

Upgrade org.keycloak:keycloak-server-spi-private to version 26.6.2 or higher.

org.keycloak:keycloak-server-spi-private is an open source identity and access management solution for modern applications and services.

Affected versions of this package are vulnerable to Authentication Bypass by Primary Weakness via the SAML Identity Provider authentication process when it is disabled. An attacker can gain unauthorized access by exploiting the ability to authenticate through a provider that should not be available.

Upgrade org.keycloak:keycloak-server-spi-private to version 26.2.14, 26.4.10, 26.5.5 or higher.