CVE-2025-14083: 
Java vulnerability analysis and mitigation

CVE-2025-14083 is an Improper Access Control vulnerability in the Keycloak Admin REST API that allows authenticated but minimally privileged users to access the /admin/realms/master/users/profile endpoint, exposing backend user profile schema and rules. It affects org.keycloak:keycloak-services versions up to and including 26.2.5. The vulnerability was reported on December 5, 2025, and publicly disclosed on January 21, 2026. It carries a CVSS v3.1 base score of 2.7 (Low), assigned by Red Hat (Github Advisory, Red Hat CVE).

The root cause is CWE-284 (Improper Access Control): the Keycloak Admin REST API fails to enforce sufficient authorization checks on the /admin/realms/master/users/profile endpoint. A user holding only the create-client permission — considered low-privilege by design — can remotely query this endpoint over the network without any additional user interaction. The endpoint returns internal user profile schema data including attribute names, validation rules, display metadata, and permission mappings, even though the attacker cannot view actual user account records. This information can be leveraged to craft targeted attacks or prepare future privilege-escalation attempts (Red Hat Bugzilla, Github Advisory).

Successful exploitation results in unauthorized disclosure of Keycloak's internal user profile schema configuration, including attribute names, validation rules, display metadata, and permission mappings. While no actual user account data is exposed and there is no integrity or availability impact, the leaked schema information could enable an attacker to craft more precise targeted attacks or inform privilege-escalation strategies against the Keycloak instance. The scope is limited to the confidentiality of backend configuration metadata within the affected realm (Red Hat Bugzilla, Github Advisory).

1. Obtain low-privilege credentials: Acquire a Keycloak account with at minimum the create-client permission in the target realm — this may be obtained through legitimate access, credential theft, or social engineering.
2. Authenticate to the Admin REST API: Use the Keycloak token endpoint to obtain an access token for the low-privilege account (e.g., via POST /realms/{realm}/protocol/openid-connect/token).
3. Query the exposed endpoint: Send an authenticated HTTP GET request to /admin/realms/master/users/profile using the obtained token: GET /admin/realms/master/users/profile with Authorization: Bearer <token>.
4. Harvest schema data: Parse the JSON response to extract internal user profile attribute names, validation rules, display metadata, and permission mappings.
5. Leverage for follow-on attacks: Use the harvested schema information to craft targeted privilege-escalation attempts or more precise attacks against the Keycloak instance or its integrated applications (Red Hat Bugzilla, Github Advisory).

• Network: Unexpected HTTP GET requests to /admin/realms/master/users/profile originating from accounts that hold only create-client or similarly low-privilege roles; access from unusual IP addresses or at unusual times.
• Logs: Keycloak server access logs showing successful 200 responses to /admin/realms/master/users/profile for accounts not expected to access administrative profile schema endpoints; repeated queries to this endpoint from the same low-privilege account.
• Authentication: Low-privilege service accounts or client accounts generating Admin REST API tokens and accessing administrative endpoints beyond their expected scope.

Red Hat has released patched versions addressing this vulnerability: Red Hat build of Keycloak 26.4.11 (via RHSA-2026:6477 and RHSA-2026:6478) and upstream Keycloak 26.5.7. Organizations should upgrade to these versions or later as the primary remediation. As a workaround, administrators should review and restrict the create-client and other low-privilege role assignments to minimize the number of accounts that could exploit this endpoint. No configuration-only workaround has been officially documented (Red Hat Errata RHSA-2026:6477, Red Hat Errata RHSA-2026:6478, Github Advisory).

The vulnerability received limited public attention given its low CVSS score and the requirement for prior authentication. Red Hat issued security advisories (RHSA-2026:6477 and RHSA-2026:6478) bundling this fix with several other Keycloak security issues, indicating it was addressed as part of a broader security update cycle. No notable independent researcher commentary or significant social media discussion has been identified beyond standard CVE tracking and aggregator coverage (Red Hat Errata RHSA-2026:6477).