CVE-2026-4629

Name of the Vulnerable Software and Affected Versions Keycloak (affected versions not specified)

Description A flaw allows a highly privileged user with manage-clients permission to perform privilege escalation by injecting a hardcoded role mapper into any client. This process enables the user to bypass scope restrictions and inject the realm-admin role into generated tokens, granting full administrative access to the realm.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.