org.keycloak:keycloak-server-spi-private 26.7.2

Direct Vulnerabilities

Known vulnerabilities in the org.keycloak:keycloak-server-spi-private package. This does not include vulnerabilities belonging to this package’s dependencies.

Fix vulnerabilities automatically

Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

Fix for free

Vulnerability	Vulnerable Version
M Reliance on Untrusted Inputs in a Security Decision org.keycloak:keycloak-server-spi-private is an open source identity and access management solution for modern applications and services. Affected versions of this package are vulnerable to Reliance on Untrusted Inputs in a Security Decision through the client authentication flow in the client policies and assertion handling components. An attacker can authenticate with weaker client credentials by supplying a fake unsigned assertion header that makes the server believe the policy requirements have been satisfied. This defeats administrator-mandated requirements for signed JWT assertions and lets a client complete authentication with a simpler method such as a client secret, weakening client authentication controls. How to fix Reliance on Untrusted Inputs in a Security Decision? Upgrade `org.keycloak:keycloak-server-spi-private` to version 26.7.3 or higher.	[13.0.0,26.7.3)
H Missing Authorization org.keycloak:keycloak-server-spi-private is an open source identity and access management solution for modern applications and services. Affected versions of this package are vulnerable to Missing Authorization through the user creation path in `UsersResource.create` and `RepresentationToModel.createGroups`. An attacker can add a newly created user to groups they are not authorized to manage by submitting a user creation request with group memberships while FGAP V2 is enabled. This lets a sub-administrator who can create users place those users into restricted groups, exposing sensitive information or granting the new accounts elevated privileges. How to fix Missing Authorization? Upgrade `org.keycloak:keycloak-server-spi-private` to version 26.7.3 or higher.	[0,26.7.3)
M Information Exposure org.keycloak:keycloak-server-spi-private is an open source identity and access management solution for modern applications and services. Affected versions of this package are vulnerable to Information Exposure through the `AuthenticationManagementResource` in `services/src/main/java/org/keycloak/services/resources/admin/AuthenticationManagementResource.java`. An attacker can retrieve raw authenticator configuration secrets by requesting authentication config data through the admin API as a user with view-only permissions. The vulnerable GET paths return `ModelToRepresentation.toRepresentation(config)` without masking sensitive entries, so values such as reCAPTCHA secret keys are exposed in the response and can also appear in administrative logs. This leaks third-party service credentials to unauthorized administrators and can expose secrets used by the realm’s authentication flows. Notes The leak is limited to the admin GET endpoints that return authenticator-config representations, so only deployments where administrators can view authentication configs through the admin API are exposed. The exposed values are those stored in authenticator config metadata, including provider-defined secrets and legacy/unknown keys that are not recognized as non-secret by the provider registry. How to fix Information Exposure? Upgrade `org.keycloak:keycloak-server-spi-private` to version 26.7.3 or higher.	[0,26.7.3)

Vulnerability

Vulnerable Version

Reliance on Untrusted Inputs in a Security Decision

org.keycloak:keycloak-server-spi-private is an open source identity and access management solution for modern applications and services.

Affected versions of this package are vulnerable to Reliance on Untrusted Inputs in a Security Decision through the client authentication flow in the client policies and assertion handling components. An attacker can authenticate with weaker client credentials by supplying a fake unsigned assertion header that makes the server believe the policy requirements have been satisfied. This defeats administrator-mandated requirements for signed JWT assertions and lets a client complete authentication with a simpler method such as a client secret, weakening client authentication controls.

How to fix Reliance on Untrusted Inputs in a Security Decision?

Upgrade org.keycloak:keycloak-server-spi-private to version 26.7.3 or higher.

[13.0.0,26.7.3)

Missing Authorization

org.keycloak:keycloak-server-spi-private is an open source identity and access management solution for modern applications and services.

Affected versions of this package are vulnerable to Missing Authorization through the user creation path in UsersResource.create and RepresentationToModel.createGroups. An attacker can add a newly created user to groups they are not authorized to manage by submitting a user creation request with group memberships while FGAP V2 is enabled. This lets a sub-administrator who can create users place those users into restricted groups, exposing sensitive information or granting the new accounts elevated privileges.

How to fix Missing Authorization?

Upgrade org.keycloak:keycloak-server-spi-private to version 26.7.3 or higher.

[0,26.7.3)

Information Exposure

org.keycloak:keycloak-server-spi-private is an open source identity and access management solution for modern applications and services.

Affected versions of this package are vulnerable to Information Exposure through the AuthenticationManagementResource in services/src/main/java/org/keycloak/services/resources/admin/AuthenticationManagementResource.java. An attacker can retrieve raw authenticator configuration secrets by requesting authentication config data through the admin API as a user with view-only permissions. The vulnerable GET paths return ModelToRepresentation.toRepresentation(config) without masking sensitive entries, so values such as reCAPTCHA secret keys are exposed in the response and can also appear in administrative logs. This leaks third-party service credentials to unauthorized administrators and can expose secrets used by the realm’s authentication flows.

Notes

The leak is limited to the admin GET endpoints that return authenticator-config representations, so only deployments where administrators can view authentication configs through the admin API are exposed.
The exposed values are those stored in authenticator config metadata, including provider-defined secrets and legacy/unknown keys that are not recognized as non-secret by the provider registry.

How to fix Information Exposure?

Upgrade org.keycloak:keycloak-server-spi-private to version 26.7.3 or higher.

[0,26.7.3)

org.keycloak:keycloak-server-spi-private@26.7.2

latest version

latest non vulnerable version

first published

latest version published

licenses detected

package registry

Direct Vulnerabilities

Fix vulnerabilities automatically