2.7

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-14083

CVE-2025-14083: Keycloak Admin REST API exposes backend schema and rules

A flaw was found in the Keycloak Admin REST API. This vulnerability allows the exposure of backend schema and rules, potentially leading to targeted attacks or privilege escalation via improper access control.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-14083

CVE-2025-14083:

2.7

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
org.keycloak:keycloak-services	maven	<= 26.2.5

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, CVE-2025-14083, describes an improper access control flaw in the Keycloak Admin REST API. According to the advisory, a user with only the create-client permission can access the /admin/realms/{realm}/users/profile endpoint, which exposes internal user profile schema and rules. This indicates that the endpoint lacks a sufficiently strict permission check.

Analysis of the keycloak/keycloak repository points to org.keycloak.services.resources.admin.UserProfileResource as the class handling this endpoint. The file path is services/src/main/java/org/keycloak/services/resources/admin/UserProfileResource.java. Within this class, two methods are responsible for exposing the data:

getConfiguration(): This method handles GET requests to the base path of the resource (/profile) and returns the user profile configuration (UPConfig).
getMetadata(): This method handles GET requests to the /profile/metadata path and returns the user profile metadata (UserProfileMetadata).

Although no specific patch commit was found through the issue tracker, the current version of UserProfileResource.java contains the auth.requireAnyAdminRole(); check in both of these methods. The presence of this check in the current code, combined with the vulnerability description, strongly implies that this check was absent in the vulnerable versions. Without this check, any user who could reach the UserProfileResource (e.g., a user with the low-privilege create-client role) would be able to execute these methods and retrieve sensitive configuration data. Therefore, these two functions are identified as the vulnerable functions.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.