CVE-2026-94215

Name of the Vulnerable Software and Affected Versions Keycloak (affected versions not specified)

Description A flaw exists in the Admin REST API of Keycloak. The API utilizes a per-request in-memory cache to resolve clients by their unique identifier but fails to verify if the client belongs to the realm specified in the request path. This allows an administrator with limited privileges to read or modify sensitive client configurations in the master realm by accessing them through a realm they control. This could result in the exposure of client credentials or the redirection of administrative login attempts to malicious sites.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.