CVE-2026-16071

Name of the Vulnerable Software and Affected Versions Keycloak (affected versions not specified)

Description A flaw exists in the LDAP storage provider used to federate user identities from external directories. When a delegated administrator performs a search using a specific LDAP entry Distinguished Name (DN), missing validation allows lookups for users located outside the configured search boundary. This can lead to the disclosure of account information from unauthorized parts of the directory and the unintended importing of those users into local storage.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.