{
  "threat_severity" : "Moderate",
  "public_date" : "2026-07-03T15:21:06Z",
  "bugzilla" : {
    "description" : "keycloak-services: keycloak-services: FGAP v2 client scope assignment bypass via ClientResource",
    "id" : "2496889",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2496889"
  },
  "cvss3" : {
    "cvss3_base_score" : "5.4",
    "cvss3_scoring_vector" : "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
    "status" : "verified"
  },
  "cwe" : "CWE-639",
  "details" : [ "A flaw was found in the ClientResource component of Keycloak's admin services when Fine-Grained Admin Permissions (FGAP) v2 is enabled. This issue allows a delegated administrator, who should only have limited control over specific clients, to attach or remove hidden client scopes that they are not authorized to see or manage. As a result, an attacker could inject unauthorized data or permissions into the security tokens issued to end-users, potentially tricking other applications into granting higher levels of access than intended.", "A flaw was found in the ClientResource component of Keycloak's admin services when Fine-Grained Admin Permissions (FGAP) v2 is enabled. This issue allows a delegated administrator, who should only have limited control over specific clients, to attach or remove hidden client scopes that they are not authorized to see or manage. As a result, an attacker could inject unauthorized data or permissions into the security tokens issued to end-users, potentially tricking other applications into granting higher levels of access than intended." ],
  "statement" : "The Red Hat Product Security team has assessed the severity of this vulnerability as Moderate, given that exploitation requires the attacker to already hold a delegated administrator role with specific client management permissions and knowledge of internal resource identifiers (UUIDs). Successful exploitation allows an attacker to bypass fine-grained authorization boundaries to modify the contents of tokens issued by Keycloak, potentially leading to unauthorized actions in downstream applications. The vulnerability's root cause is a missing authorization check on the referenced client scope during the assignment process in the admin REST API.",
  "acknowledgement" : "Red Hat would like to thank yd1ng for reporting this issue.",
  "affected_release" : [ {
    "product_name" : "Red Hat build of Keycloak 26.4",
    "release_date" : "2026-08-05T00:00:00Z",
    "advisory" : "RHSA-2026:50847",
    "cpe" : "cpe:/a:redhat:build_keycloak:26.4::el9",
    "package" : "rhbk/keycloak-operator-bundle:26.4.14-1"
  }, {
    "product_name" : "Red Hat build of Keycloak 26.4",
    "release_date" : "2026-08-05T00:00:00Z",
    "advisory" : "RHSA-2026:50847",
    "cpe" : "cpe:/a:redhat:build_keycloak:26.4::el9",
    "package" : "rhbk/keycloak-rhel9:26.4-22"
  }, {
    "product_name" : "Red Hat build of Keycloak 26.4",
    "release_date" : "2026-08-05T00:00:00Z",
    "advisory" : "RHSA-2026:50847",
    "cpe" : "cpe:/a:redhat:build_keycloak:26.4::el9",
    "package" : "rhbk/keycloak-rhel9-operator:26.4-22"
  }, {
    "product_name" : "Red Hat build of Keycloak 26.4.14",
    "release_date" : "2026-08-05T00:00:00Z",
    "advisory" : "RHSA-2026:50846",
    "cpe" : "cpe:/a:redhat:build_keycloak:26.4::el9",
    "package" : "rhbk/keycloak-rhel9"
  }, {
    "product_name" : "Red Hat build of Keycloak 26.6",
    "release_date" : "2026-08-05T00:00:00Z",
    "advisory" : "RHSA-2026:50849",
    "cpe" : "cpe:/a:redhat:build_keycloak:26.6::el9",
    "package" : "rhbk/keycloak-operator-bundle:26.6.5-1"
  }, {
    "product_name" : "Red Hat build of Keycloak 26.6",
    "release_date" : "2026-08-05T00:00:00Z",
    "advisory" : "RHSA-2026:50849",
    "cpe" : "cpe:/a:redhat:build_keycloak:26.6::el9",
    "package" : "rhbk/keycloak-rhel9:26.6-11"
  }, {
    "product_name" : "Red Hat build of Keycloak 26.6",
    "release_date" : "2026-08-05T00:00:00Z",
    "advisory" : "RHSA-2026:50849",
    "cpe" : "cpe:/a:redhat:build_keycloak:26.6::el9",
    "package" : "rhbk/keycloak-rhel9-operator:26.6-11"
  }, {
    "product_name" : "Red Hat build of Keycloak 26.6.5",
    "release_date" : "2026-08-05T00:00:00Z",
    "advisory" : "RHSA-2026:50848",
    "cpe" : "cpe:/a:redhat:build_keycloak:26.6::el9",
    "package" : "rhbk/keycloak-rhel9"
  } ],
  "package_state" : [ {
    "product_name" : "Red Hat Build of Keycloak",
    "fix_state" : "Not affected",
    "package_name" : "keycloak-services",
    "cpe" : "cpe:/a:redhat:build_keycloak:"
  }, {
    "product_name" : "Red Hat Build of Keycloak",
    "fix_state" : "Not affected",
    "package_name" : "rhbk-openshift-rhel9/rhbk-openshift-rhel9",
    "cpe" : "cpe:/a:redhat:build_keycloak:"
  }, {
    "product_name" : "Red Hat Data Grid 8",
    "fix_state" : "Not affected",
    "package_name" : "keycloak-services",
    "cpe" : "cpe:/a:redhat:jboss_data_grid:8"
  }, {
    "product_name" : "Red Hat JBoss Enterprise Application Platform Expansion Pack",
    "fix_state" : "Not affected",
    "package_name" : "keycloak-services",
    "cpe" : "cpe:/a:redhat:jbosseapxp"
  }, {
    "product_name" : "Red Hat Single Sign-On 7",
    "fix_state" : "Not affected",
    "package_name" : "keycloak-services",
    "cpe" : "cpe:/a:redhat:red_hat_single_sign_on:7"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2026-14614\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-14614" ],
  "name" : "CVE-2026-14614",
  "csaw" : false
}