Orta CVSS 6.5
CVE-2026-9797: CVE-2026-9797: güvenlik açığı
Açıklama (NVD)
A flaw was found in Keycloak's administrative services (org.keycloak.services.resources.admin). A highly privileged attacker, authenticated with a 'manage-clients' role, could exploit this vulnerability through several methods, including manipulating client JSON Web Key Sets (JWKS), swapping client authenticator types and resetting secrets, or downloading legitimate signing keys. Successful exploitation allows the attacker to obtain a token with 'realm-admin' role assignments, leading to privilege escalation and potential unauthorized access to sensitive resources.
Özet bilgiler
- CVSS v3.1
- 6.5
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N - EPSS
- %0,32 (yüzdelik 25)
- CWE
- CWE-266
- Yama
- Yok / bilinmiyor