CVE-2026-16108

Name of the Vulnerable Software and Affected Versions Keycloak (affected versions not specified)

Description A flaw exists in the realm representation and the 'default-groups' REST endpoint, which manages groups automatically assigned to new users within a realm. A delegated administrator with realm-viewing permissions can view the names and identifiers of hidden default groups without having the required specific permissions. This may result in the exposure of internal group names or sensitive organizational structures.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.