CVE-2026-18201: Keycloak-services: keycloak-services: generic identity-provider creation can bind brokers to organizations without manage-organizations
A flaw was found in Keycloak. The generic identity-provider REST endpoint (/admin/realms/{realm}/identity-provider/instances) allows a user with only manage-identity-providers permission to bind a newly created identity provider to an organization by including an organizationId in the request payload. While the organization-scoped endpoint correctly requires both manage-identity-providers and manage-organizations permissions, the generic endpoint fails to enforce the manage-organizations check. This allows an IdP operator to associate brokers with organizations they are not authorized to manage, influencing organization login flows and broker selection. Additionally, this path skips organization IdP-list cache invalidation, making the newly bound broker invisible in cached organization IdP listings.
Other sources
Keycloak provides a way to manage identity providers and organizations through its administrative API. A flaw was discovered where an administrator with permission to manage identity providers could link a new provider to an organization without having the required permissions to manage that organization. This could allow an unauthorized administrator to influence how users log into specific organizations.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-18201?
CVE-2026-18201 has a medium severity score of 5.5.
How can CVE-2026-18201 be exploited?
CVE-2026-18201 can be exploited by a user with manage-identity-providers permission who can bind a new identity provider to an organization.
What permissions are required for CVE-2026-18201 exploitation?
Exploitation of CVE-2026-18201 requires only the manage-identity-providers permission.
How do I fix CVE-2026-18201?
To mitigate CVE-2026-18201, review and restrict permissions for users managing identity providers.
What software is affected by CVE-2026-18201?
CVE-2026-18201 affects Keycloak software specifically in its keycloak-services module.