Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.keycloak:keycloak-services | maven | < 26.4.12 | 26.4.12 |
| org.keycloak:keycloak-services | maven | >= 26.5.0, < 26.6.2 | 26.6.2 |
Miggo AIRoot Cause AnalysisThe analysis of the provided commits clearly indicates that the vulnerability lies within the user method of the org.keycloak.services.resources.account.resources.ResourceService class. Both commits, 33f6f873fda2c9546e52d34b4f865eafc42df0c0 and b68070bcf96a6fe7d0f01cee5d3cbde71f2abbe7, patch this exact same method. The vulnerability stems from a lack of authorization checks. The original code would fetch and return user information based on a query parameter without verifying if the authenticated user making the request had the right to access that information. This allowed any authenticated user to enumerate other users' PII. The patch rectifies this by adding a crucial security check: it verifies if the ID of the user being queried matches the ID of the authenticated user, or if the authenticated user has a permission request associated with the queried user. If neither condition is met, access is denied with a 'Forbidden' status. The vulnerable function is therefore org.keycloak.services.resources.account.resources.ResourceService.user.
