@keycloak/keycloak-admin-ui@26.5.2

@keycloak/keycloak-admin-ui is a This project is the next generation of the Keycloak Admin UI. It is written with React and PatternFly 4 and uses Vite.

Affected versions of this package are vulnerable to Insertion of Sensitive Information Into Sent Data through OrganizationInvitationResource.toRepresentation() in OrganizationInvitationResource.java. An attacker can retrieve the secret invitation link by creating or listing an organization invitation through the admin REST API, then use that link to register new accounts and add them to the organization without manage-users permission or access to the invited mailbox. This lets a delegated organization administrator bypass the intended invitation workflow and create unauthorized organization members.

Notes

• The leaked link was exposed in both the single-invitation get response and the invitations list response, so any caller with organization-invitation read access could recover it without going through the email-delivery path.
• The admin console also rendered a “Copy invite link” action from the same response field, so deployments using the web UI exposed the secret link there as well as through the REST API.

A fix was pushed into the master branch but not yet published.