CVE-2026-12388: Keycloak-broker: keycloak: privilege escalation to realm administrator via improper authorization in identity provider mapper
A flaw was found in the Identity Provider (IdP) mapper component of Keycloak, which is used to manage how user information from external services is mapped to Keycloak users. An administrator with limited permissions to manage identity providers can exploit this flaw by creating a "Hardcoded Role" mapper that assigns high-level administrative roles (like realm-admin) to themselves or others. This allows a restricted administrator to bypass security checks and gain full control over the entire realm.
Other sources
An improper authorization flaw was discovered in the org.keycloak.broker component of Keycloak. The identity provider mapper endpoint fails to enforce the requireMapRole authorization check, which is standard for other role-mapping endpoints. An attacker with the manage-identity-providers permission can exploit this by: Configuring a new OIDC or SAML Identity Provider (IdP) pointing to a server they control.
Adding a "Hardcoded Role" mapper to that IdP that targets a high-privilege role, such as realm-admin.
Authenticating through the malicious IdP.
Because the mapper does not verify if the administrator has the authority to grant the target role, the role is successfully injected into the user's session, resulting in a full privilege escalation from a delegated administrator to a realm administrator. This issue is distinct from CVE-2026-4629, as it resides in a different code path related to IdP mappers rather than client management.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-12388?
The severity of CVE-2026-12388 is classified as medium with a score of 6.5.
How do I fix CVE-2026-12388?
To fix CVE-2026-12388, update Keycloak to the latest version that addresses the improper authorization in the identity provider mapper.
What does CVE-2026-12388 affect?
CVE-2026-12388 affects the Keycloak-broker component, specifically related to improper authorization handling.
Who can exploit CVE-2026-12388?
An administrator with limited permissions can exploit CVE-2026-12388 to escalate privileges to realm administrator.
What type of vulnerability is CVE-2026-12388?
CVE-2026-12388 is a privilege escalation vulnerability due to improper authorization in the identity provider mapper.