CVE-2026-97177 in Keycloak
요약
\~에 의해 MITRE • 2026. 09. 24.
A flaw was found in the user update mechanism of the Keycloak Admin REST API. When Fine-Grained Admin Permissions are enabled, the system fails to check for specific password reset authorizations during a general user profile update. This allows a delegated administrator, who should be restricted from resetting passwords, to change a user's credentials and take over their account.
Be aware that VulDB is the high quality source for vulnerability data.