CVE-2025-14777 - CVE House

Back to Database

Status published Medium CVE-2025-14777

Keycloak: keycloak idor in realm client creating/deleting

6 CVSS

Vulnerability Description

A flaw was found in Keycloak. An IDOR (Broken Access Control) vulnerability exists in the admin API endpoints for authorization resource management, specifically in ResourceSetService and PermissionTicketService. The system checks authorization against the resourceServer (client) ID provided in the API request, but the backend database lookup and modification operations (findById, delete) only use the resourceId. This mismatch allows an authenticated attacker with fine-grained admin permissions for one client (e.g., Client A) to delete or update resources belonging to another client (Client B) within the same realm by supplying a valid resource ID.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-14777

Check My Exposure

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

Red Hat would like to thank Joshua Rogers for reporting this issue.

References

More from Red Hat

View All →

Aap-gateway: improper path validation in gateway allows credential exfiltration

Event-driven-ansible: sensitive internal headers disclosure in aap eda event streams

Event-driven-ansible: event stream test mode exposes sensitive headers in aap eda

Libsoup: improper handling of http vary header in libsoup caching

Gnutls: stack-based buffer overflow in gnutls_pkcs11_token_init() function

Affected Vendor

Red Hat

View all reports →

Affected Software

Red Hat build of Keycloak 26.4, Red Hat build of Keycloak 26.4.11

Vulnerable Versions:

26.4.11-1, 26.4-14

Timeline

Official Publish: December 16th, 2025

Last Modified: April 2nd, 2026

Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:L

Weaknesses (CWE)

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.