Sign in
Deutsch English Español Polski
Medium

Improper Authorization in Keycloak Organization Mapper Allows Unauthorized Organization Claims

  • Disclosed: 10.03.2025
  • Updated: 11.10.2026 12:21

This vulnerability is caused by the improper mapping of users to organizations based solely on email/username patterns. The issue is limited to the token claim level, meaning the user is not truly added to the organization but may appear as such in applications relying on these claims. The risk increases in scenarios where self-registration is enabled and unrestricted, allowing an attacker to exploit the naming pattern. The issue is mitigated if admins restrict registration or use strict validation mechanisms.

Affected software

Click a technology to see all vulnerabilities affecting it.

PlatformPackageVulnerable versionsFixed in
Java / Kotlin (Maven) org.keycloak:keycloak-services >= 26.1.0, < 26.1.3, < 26.0.10 26.1.3, 26.0.10

References

CVSS score 5.4/10
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Weakness (CWE)
CWE-284
Platform
Java / Kotlin (Maven)
Package
org.keycloak:keycloak-services
Disclosed
10.03.2025
Updated
11.10.2026 12:21

Sources and licenses

OSV / GitHub Advisory Database - GHSA-gvgg-2r3r-53x7 - CC BY 4.0

Vulnerability history: org.keycloak:keycloak-services

All published vulnerabilities of this package (Java / Kotlin (Maven)), newest first. Shows whether this is a one-off slip or a package that needs watching.

All (98) in the archive
Total entries
98
First → latest
01.2022 08.2026
Without a fix
16
Exploited in attacks
0

Severity breakdown

  • Critical 3
  • High 26
  • Medium 51
  • Low 18

Disclosures per year

Severity:
  1. Keycloak: Unauthenticated account takeover via reset-credentials flow bypass
    Critical · 9.1 CVE-2026-18963 >= 26.0.0, < 26.4.15, >= 26.5.0, < 26.6.6, >= 26.7.0, < 26.7.2 26.4.15, 26.6.6, 26.7.2
  2. Keycloak: Unauthorized access via improper validation of encrypted SAML assertions
    High · 7.7 CVE-2026-2092 <= 26.2.5, >= 26.3.0, <= 26.4.7, >= 26.5.0 no fix
  3. Keycloak has privilege escalation via improper scope mapping enforcement
    High · 7.3 CVE-2026-9795 < 26.6.4 26.6.4
  4. Keycloak: Open redirect when using wildcard valid redirect URIs in Keycloak
    High · 8.1 CVE-2026-7504 < 26.6.2 26.6.2
  5. Keycloak: Session fixation in OIDC login flow that can lead to account takeover
    High · 7.5 CVE-2026-7507 < 26.6.2 26.6.2
  6. Keycloak: Access token disclosure and implicit flow bypass via forged client data
    High · 7.1 CVE-2026-7571 < 26.6.2 26.6.2
  7. Keycloak: Privilege escalation via forged authorization codes due to SingleUseObjectProvider isolation flaw
    High · 7.4 CVE-2026-4282 < 26.5.7 26.5.7
  8. Keycloak: Application-Level DoS via Scope Processing
    High · 7.5 CVE-2026-4634 < 26.5.7 26.5.7
  9. Keycloak: UMA Policy Resource Injection Allows Unauthorized Cross-User Permission Grants
    High · 8.1 CVE-2026-4636 < 26.5.7 26.5.7
  10. Keycloak: Redirect URI validation bypass via ..;/ path traversal in OIDC auth endpoint
    High · 7.3 CVE-2026-3872 < 26.5.7 26.5.7
  11. Keycloak: Unauthorized authentication via disabled SAML Identity Provider
    High · 8.1 CVE-2026-2603 < 26.5.5 26.5.5
  12. Keycloak allows authentication using an Identity Provider (IdP) even after it has been disabled by an administrator
    High · 8.1 CVE-2026-3009 < 26.5.5 26.5.5
  13. Keycloak fails to verify if an Identity Provider (IdP) is enabled before issuing tokens
    High · 8.8 CVE-2026-1486 >= 26.5.0, < 26.5.3, < 26.4.9 26.5.3, 26.4.9
  14. Keycloak affected by improper invitation token validation
    High · 8.1 CVE-2026-1529 >= 26.5.0, < 26.5.3, < 26.2.13, >= 26.3.0, < 26.4.9 26.5.3, 26.2.13, 26.4.9
  15. Keycloak hostname verification
    High · 8.2 CVE-2025-3501 < 26.2.2 26.2.2
  16. Improper Authorization in Keycloak Organization Mapper Allows Unauthorized Organization Claims this entry
    Medium · 5.4 CVE-2025-1391 >= 26.1.0, < 26.1.3, < 26.0.10 26.1.3, 26.0.10
  17. org.keycloak:keycloak-services has Inefficient Regular Expression Complexity
    High · 6.5 CVE-2024-10270 < 24.0.9, >= 25.0.0, < 26.0.6 24.0.9, 26.0.6
  18. Keycloak has session fixation in Elytron SAML adapters
    High · 7.1 CVE-2024-7341 < 22.0.12, >= 23.0.0, < 24.0.7, >= 25.0.0, < 25.0.5 22.0.12, 24.0.7, 25.0.5
  19. Keycloak's admin API allows low privilege users to use administrative functions
    High · 8.1 CVE-2024-3656 < 24.0.5 24.0.5
  20. Keycloak exposes sensitive information in Pushed Authorization Requests (PAR)
    High · 7.5 CVE-2024-4540 < 24.0.5 24.0.5
Show more (10) Showing 20 of 30

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application
DockRay newsletter

Application security in your inbox

Important vulnerabilities, actionable guidance and practical advice for your applications. Choose your technologies and follow what matters to your project.

  • A daily digest of new vulnerabilities, critical ones included.
  • Notifications about important updates.
  • Practical advice on application security and monitoring.

Leave empty to receive updates for every technology.

Privacy policy

Free to subscribe. Unsubscribe with one click in any email.