CVE-2025-13881 in Keycloak
Summary
by MITRE • 02/02/2026
A flaw was found in Keycloak Admin API. This vulnerability allows an administrator with limited privileges to retrieve sensitive custom attributes via the /unmanagedAttributes endpoint, bypassing User Profile visibility settings.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 02/03/2026
The vulnerability identified as CVE-2025-13881 represents a critical access control flaw within the Keycloak identity management platform, specifically affecting the Admin API functionality. This issue resides in the user profile attribute handling mechanism where the system fails to properly enforce visibility restrictions for custom attributes. The flaw manifests through the /unmanagedAttributes endpoint which should ideally respect the configured visibility settings for user profile attributes but instead permits unauthorized access to sensitive data. This vulnerability directly impacts the principle of least privilege and data protection mechanisms that Keycloak implements to safeguard user information.
The technical implementation of this vulnerability stems from inadequate validation within the Keycloak Admin API's attribute retrieval logic. When administrators access the /unmanagedAttributes endpoint, the system should verify that the requesting user possesses appropriate permissions to view the specific custom attributes in question. However, the flaw allows privilege escalation where users with limited administrative rights can bypass the normal visibility checks that should restrict access to sensitive profile data. This represents a classic case of insufficient authorization controls and improper access validation that violates fundamental security principles. The vulnerability aligns with CWE-284 Access Control Issues, specifically targeting improper access control mechanisms within the administrative interface.
The operational impact of this vulnerability extends beyond simple data exposure to potentially compromise the integrity of the entire identity management system. Attackers who can exploit this flaw gain unauthorized access to sensitive user information that may include personal identifiers, security credentials, or other confidential attributes stored within the user profiles. This capability undermines the trust model that organizations rely upon when implementing Keycloak as their identity and access management solution. The vulnerability particularly affects environments where organizations have implemented strict data governance policies and where user privacy regulations such as GDPR or CCPA are enforced, as unauthorized access to custom attributes could constitute regulatory violations and expose organizations to significant legal and financial risks.
Organizations utilizing Keycloak should immediately implement mitigations including updating to the latest patched version of the software, reviewing and strengthening administrative access controls, and implementing additional monitoring for suspicious API access patterns. The vulnerability demonstrates the importance of comprehensive access control testing and the need for regular security assessments of administrative interfaces. Security teams should also consider implementing network segmentation and API gateway controls to limit access to sensitive endpoints. This flaw highlights the necessity of following ATT&CK framework principles for privilege escalation and credential access, particularly focusing on the techniques related to unauthorized access to sensitive data and the exploitation of administrative interfaces. Organizations should conduct immediate audits of their Keycloak configurations to ensure proper attribute visibility settings are enforced and that administrative users have appropriate privilege levels based on their roles and responsibilities.