5.4
Medium
CVE-2025-1391 A flaw was found in the Keycloak organization feature, which allows the incorrect assignment of an organization to a…
Description
A flaw was found in the Keycloak organization feature, which allows the incorrect assignment of an organization to a user if their username or email matches the organization’s domain pattern. This issue occurs at the mapper level, leading to misrepresentation in tokens. If an application relies on these claims for authorization, it may incorrectly assume a user belongs to an organization they are not a member of, potentially granting unauthorized access or privileges.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Red Hat Build of Keycloak | Versions not published | |
| Red Hat build of Keycloak 26.0 26.0 | earliest → < 26.0-12 | 26.0-12 |
References
- RHSA-2025:2544 access.redhat.com
- RHSA-2025:2545 access.redhat.com
- access.redhat.com access.redhat.com
- RHBZ#2346082 bugzilla.redhat.com
- github.com github.com
- github.com github.com
Timeline
- Published
- Last modified
Other CVEs of Red Hat Build of Keycloak
The 275 CVEs of Red Hat Build of Keycloak →
CVE-2026-97848
Keycloak-services: keycloak-services: protocol mapper with jsontype=json bypasses token sanitization
6.5
Medium
CVE-2026-97367
Keycloak-services: keycloak-services: dcr azp and sid claim substitution allows account rest session takeover
6.4
Medium
CVE-2026-96547
Keycloak-services: keycloak-services: dcr registration-time claim-path gap allows forging realm_access.roles
6.5
Medium
CVE-2026-96460
Keycloak-services: keycloak-services: indefinite access token renewal via standard token exchange v2
5.4
Medium