CVE-2026-9791: Keycloak Organization Metadata Disclosure in OIDC Tokens

Technical summary

CVE-2026-9791 is an authorization bypass vulnerability in Keycloak related to improper metadata disclosure. An authenticated attacker with existing organization membership can invoke the account API or request an OIDC token with the 'organization' scope to extract organization metadata from tokens. The flaw persists even when the Organizations feature is administratively disabled, violating the principle of least privilege and the expectation that disabled features should not leak sensitive information. The vulnerability maps to CWE-863 (Incorrect Authorization) and is assigned a CVSS 3.1 score of 4.3 (Medium severity) under a low-complexity network vector with low privilege requirements.

Business impact

The disclosure of organization metadata in tokens could enable lateral movement or privilege escalation within federated identity deployments. Downstream applications relying on organization claims to enforce access control may grant unauthorized access based on stale organizational information. This is particularly concerning in multi-tenant environments where strict organizational boundaries are critical for data isolation. Remediation delays extend exposure, especially in large deployments where patch deployment cycles are lengthy.

Affected systems

Red Hat Build of Keycloak is the primary affected product. Organizations using Keycloak for identity and access management, particularly those leveraging the Organizations feature or those with multi-tenant architectures, should assess their exposure. The vulnerability requires authentication, so unauthenticated attackers cannot trigger it directly; however, any user account with organization membership can exploit it.

Exploitability

Exploitability is straightforward for an attacker with valid credentials. The attack vector is network-based, requires low privilege (basic user account), and involves no complex interactions or user interaction (UI:N). An attacker simply authenticates and requests a token with the 'organization' scope or calls the account API to retrieve metadata. No specialized tools or advanced techniques are required. However, the attack requires pre-existing legitimate access—an attacker must already be an authenticated member of an organization. The CVSS score of 4.3 reflects this limited blast radius.

Remediation

Keycloak administrators should immediately apply patches provided by Red Hat for the Build of Keycloak. Verify the specific patch version in the Red Hat security advisory. As an interim mitigation, review organization feature usage and disable the Organizations feature entirely if not actively required. Audit token scopes issued in OIDC flows to ensure 'organization' claims are not granted to applications that do not require them. Monitor logs for suspicious requests to the account API from users with organization membership.

Patch guidance

Consult the Red Hat Build of Keycloak security advisory for the specific version addressing CVE-2026-9791. Once available, prioritize patching non-production instances first to test token claim behavior and verify that organization metadata is no longer exposed after the patch is applied. Update OIDC scope policies to remove unnecessary 'organization' scope claims from client configurations. Test all dependent applications to confirm they handle the absence of organization metadata correctly.

Detection guidance

Monitor account API access logs for unusual patterns of requests from authenticated users, particularly those accessing organization-related endpoints. Inspect issued OIDC tokens for the presence of organization claims; tokens from instances with Organizations disabled should never contain such claims. Set up alerts for token requests that include the 'organization' scope, especially from service accounts or users outside your trusted administrator groups. Review token lifetime and rotation policies to limit the window in which leaked metadata can be exploited.

Why prioritize this

Although the CVSS score is medium (4.3) and the attack requires authentication, the vulnerability poses a real risk in multi-tenant and federated identity scenarios. The implicit trust that administrators place in disabled features being truly inactive makes this a priority for remediation. Organizations with sensitive organizational boundaries (healthcare, finance, government sectors) should patch promptly. The vulnerability is not listed on the KEV (Known Exploited Vulnerabilities) catalog, but the straightforward attack mechanism and low complexity mean active exploitation could emerge quickly.

Risk score, explained

The CVSS 3.1 score of 4.3 (Medium) reflects the combination of a low attack complexity, low privilege requirement, and network-based vector, but is tempered by the authentication requirement and limited impact scope (confidentiality impact only; no integrity or availability impact). The score appropriately characterizes a vulnerability that is easy to exploit but affects only information disclosure. In practice, the business risk may be higher in organizations where unauthorized access to organizational metadata could cascade into broader access control failures.

Frequently asked questions