org.keycloak:keycloak-server-spi-private 26.6.2

Direct Vulnerabilities

Known vulnerabilities in the org.keycloak:keycloak-server-spi-private package. This does not include vulnerabilities belonging to this package’s dependencies.

Fix vulnerabilities automatically

Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

Fix for free

Vulnerability	Vulnerable Version
M Information Exposure org.keycloak:keycloak-server-spi-private is an open source identity and access management solution for modern applications and services. Affected versions of this package are vulnerable to Information Exposure through the `AuthenticationManagementResource` in `services/src/main/java/org/keycloak/services/resources/admin/AuthenticationManagementResource.java`. An attacker can retrieve raw authenticator configuration secrets by requesting authentication config data through the admin API as a user with view-only permissions. The vulnerable GET paths return `ModelToRepresentation.toRepresentation(config)` without masking sensitive entries, so values such as reCAPTCHA secret keys are exposed in the response and can also appear in administrative logs. This leaks third-party service credentials to unauthorized administrators and can expose secrets used by the realm’s authentication flows. Notes The leak is limited to the admin GET endpoints that return authenticator-config representations, so only deployments where administrators can view authentication configs through the admin API are exposed. The exposed values are those stored in authenticator config metadata, including provider-defined secrets and legacy/unknown keys that are not recognized as non-secret by the provider registry. How to fix Information Exposure? A fix was pushed into the `master` branch but not yet published.	[0,)
L Insufficient Granularity of Access Control org.keycloak:keycloak-server-spi-private is an open source identity and access management solution for modern applications and services. Affected versions of this package are vulnerable to Insufficient Granularity of Access Control in the group retrieval due to an improper conditional check that fails to apply permission filters when FGAP v2 is enabled. An attacker can access sensitive group metadata and attributes by querying child groups through a parent group endpoint without having the necessary per-child view permissions. Note: This is only exploitable if the attacker possesses a delegated administrator role with specific permissions. How to fix Insufficient Granularity of Access Control? Upgrade `org.keycloak:keycloak-server-spi-private` to version 26.7.1 or higher.	[0,26.7.1)
M Insufficient Granularity of Access Control org.keycloak:keycloak-server-spi-private is an open source identity and access management solution for modern applications and services. Affected versions of this package are vulnerable to Insufficient Granularity of Access Control in the `getMembers()` methods that serve the group members endpoint. An admin user with delegated access to read group memberships and users can read user profile attributes that are explicitly configured to be denied by using their delegated administrative access to expose those values over the group membership API. How to fix Insufficient Granularity of Access Control? Upgrade `org.keycloak:keycloak-server-spi-private` to version 26.6.3 or higher.	[,26.6.3)
H Incorrect Authorization org.keycloak:keycloak-server-spi-private is an open source identity and access management solution for modern applications and services. Affected versions of this package are vulnerable to Incorrect Authorization via the user-facing APIs when the Organizations feature is disabled. An attacker can access organization membership data and obtain tokens containing organization claims by making authenticated requests, even after an administrator has disabled the feature at the realm level. How to fix Incorrect Authorization? Upgrade `org.keycloak:keycloak-server-spi-private` to version 26.6.3 or higher.	[,26.6.3)

Vulnerability

Vulnerable Version

Information Exposure

org.keycloak:keycloak-server-spi-private is an open source identity and access management solution for modern applications and services.

Affected versions of this package are vulnerable to Information Exposure through the AuthenticationManagementResource in services/src/main/java/org/keycloak/services/resources/admin/AuthenticationManagementResource.java. An attacker can retrieve raw authenticator configuration secrets by requesting authentication config data through the admin API as a user with view-only permissions. The vulnerable GET paths return ModelToRepresentation.toRepresentation(config) without masking sensitive entries, so values such as reCAPTCHA secret keys are exposed in the response and can also appear in administrative logs. This leaks third-party service credentials to unauthorized administrators and can expose secrets used by the realm’s authentication flows.

Notes

The leak is limited to the admin GET endpoints that return authenticator-config representations, so only deployments where administrators can view authentication configs through the admin API are exposed.
The exposed values are those stored in authenticator config metadata, including provider-defined secrets and legacy/unknown keys that are not recognized as non-secret by the provider registry.

How to fix Information Exposure?

A fix was pushed into the master branch but not yet published.

[0,)

Insufficient Granularity of Access Control

org.keycloak:keycloak-server-spi-private is an open source identity and access management solution for modern applications and services.

Affected versions of this package are vulnerable to Insufficient Granularity of Access Control in the group retrieval due to an improper conditional check that fails to apply permission filters when FGAP v2 is enabled. An attacker can access sensitive group metadata and attributes by querying child groups through a parent group endpoint without having the necessary per-child view permissions.

Note: This is only exploitable if the attacker possesses a delegated administrator role with specific permissions.

How to fix Insufficient Granularity of Access Control?

Upgrade org.keycloak:keycloak-server-spi-private to version 26.7.1 or higher.

[0,26.7.1)

Insufficient Granularity of Access Control

org.keycloak:keycloak-server-spi-private is an open source identity and access management solution for modern applications and services.

Affected versions of this package are vulnerable to Insufficient Granularity of Access Control in the getMembers() methods that serve the group members endpoint. An admin user with delegated access to read group memberships and users can read user profile attributes that are explicitly configured to be denied by using their delegated administrative access to expose those values over the group membership API.

How to fix Insufficient Granularity of Access Control?

Upgrade org.keycloak:keycloak-server-spi-private to version 26.6.3 or higher.

[,26.6.3)

Incorrect Authorization

org.keycloak:keycloak-server-spi-private is an open source identity and access management solution for modern applications and services.

Affected versions of this package are vulnerable to Incorrect Authorization via the user-facing APIs when the Organizations feature is disabled. An attacker can access organization membership data and obtain tokens containing organization claims by making authenticated requests, even after an administrator has disabled the feature at the realm level.

How to fix Incorrect Authorization?

Upgrade org.keycloak:keycloak-server-spi-private to version 26.6.3 or higher.

[,26.6.3)

org.keycloak:keycloak-server-spi-private@26.6.2

latest version

first published

latest version published

licenses detected

package registry

Direct Vulnerabilities

Fix vulnerabilities automatically