5.4
Medium
CVE-2025-1391 A flaw was found in the Keycloak organization feature, which allows the incorrect assignment of an organization to a…
Description
A flaw was found in the Keycloak organization feature, which allows the incorrect assignment of an organization to a user if their username or email matches the organization’s domain pattern. This issue occurs at the mapper level, leading to misrepresentation in tokens. If an application relies on these claims for authorization, it may incorrectly assume a user belongs to an organization they are not a member of, potentially granting unauthorized access or privileges.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Red Hat Build of Keycloak | Versions not published | |
| Red Hat build of Keycloak 26.0 26.0 | earliest → < 26.0-12 | 26.0-12 |
References
- RHSA-2025:2544 access.redhat.com
- RHSA-2025:2545 access.redhat.com
- access.redhat.com access.redhat.com
- RHBZ#2346082 bugzilla.redhat.com
- github.com github.com
- github.com github.com
Timeline
- Published
- Last modified
Other CVEs of Red Hat Build of Keycloak
The 276 CVEs of Red Hat Build of Keycloak →
CVE-2026-9797
Keycloak: keycloak: privilege escalation via client authentication manipulation by an authenticated administrator
6.5
Medium
CVE-2026-97848
Keycloak-services: keycloak-services: protocol mapper with jsontype=json bypasses token sanitization
6.5
Medium
CVE-2026-97367
Keycloak-services: keycloak-services: dcr azp and sid claim substitution allows account rest session takeover
6.4
Medium
CVE-2026-96547
Keycloak-services: keycloak-services: dcr registration-time claim-path gap allows forging realm_access.roles
6.5
Medium