CVE-2026-97177: Red Hat Build Of Keycloak

Medium severity, CVSS 6.6. EPSS: 0.2% chance of exploitation in the next 30 days.

A flaw was found in the user update mechanism of the Keycloak Admin REST API. When Fine-Grained Admin Permissions are enabled, the system fails to check for specific password reset authorizations during a general user profile update. This allows a delegated administrator, who should be restricted from resetting passwords, to change a user's credentials and take over their account.

Affected products

• Red Hat Red Hat Build Of Keycloak
• Red Hat Red Hat Single Sign-On 7

Published 2026-09-24. Last modified 2026-09-24.