CVE-2025-14083CWE-284

Keycloak-server: keycloak: improper access control in admin rest api leads to information disclosure

Low · published January 21, 2026

CVSS v3.1
2.7
EPSS
0%
Percentile
27.6
In the wild
Unconfirmed
What it is

A flaw was found in the Keycloak Admin REST API. This vulnerability allows the exposure of backend schema and rules, potentially leading to targeted attacks or privilege escalation via improper access control.

The record
Technical detail
CVSS v3.1
2.7 · LOW
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00351 · 27.6th percentile
Weakness
CWE-284 · Improper Access Control
Published
2026-01-21T12:04Z
EPSS history
Timeline
  • 21 JAN 12:04Z
    Keycloak-server: keycloak: improper access control in admin rest api leads to information disclosure
    cvelistv5