CVE-2026-94217

Name of the Vulnerable Software and Affected Versions Keycloak (affected versions not specified)

Description A flaw exists in the User-Managed Access (UMA) implementation. The issue occurs at the authorization token endpoint when processing permission tickets. If two different users own resources with the same name, the system incorrectly merges permissions from both resources during an authorization token request. This allows an attacker to obtain access scopes for a victim's resource that were not intended to be shared.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.