CVE-2026-94001 - Keycloak-services: keycloak-services: admin credential delete bypasses denied reset-password permission
Brief
CVE ID : CVE-2026-94001
Published : Sept. 19, 2026, 3:17 p. m.
- 1 hour, 39 minutes ago
Description : A flaw was found in the Admin REST API of Keycloak, an open-source identity and access management solution. The endpoint used for deleting user credentials does not correctly check for fine-grained reset-password permissions. This allows a delegated administrator, who should be restricted from resetting passwords, to delete a user's password credentials, resulting in the user being unable to log in.
Severity: 6.5
- MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...