CVE-2026-14614: Red Hat Build Of Keycloak

Medium severity, CVSS 5.4. EPSS: 0.3% chance of exploitation in the next 30 days.

A flaw was found in the ClientResource component of Keycloak's admin services when Fine-Grained Admin Permissions (FGAP) v2 is enabled. This issue allows a delegated administrator, who should only have limited control over specific clients, to attach or remove hidden client scopes that they are not authorized to see or manage. As a result, an attacker could inject unauthorized data or permissions into the security tokens issued to end-users, potentially tricking other applications into granting higher levels of access than intended.

Affected products

• Red Hat Build Of Keycloak: from 26.4, before 26.4.14 (fixed in 26.4.14); from 26.6, before 26.6.5 (fixed in 26.6.5)

Published 2026-07-03. Last modified 2026-08-11.