Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.keycloak:keycloak-services | maven | < 26.6.2 | 26.6.2 |
Miggo AIRoot Cause AnalysisThe vulnerability is an Insecure Direct Object Reference (IDOR) in Keycloak's Authorization Services Protection API. The analysis of the provided patches reveals that several methods in the org.keycloak.authorization.protection.resource.ResourceService class were missing ownership checks. Specifically, the create, update, delete, findById, and find methods could be exploited. An authenticated attacker could craft requests with known resource UUIDs to perform unauthorized actions (create, read, update, delete) on resources belonging to other users within the same realm. The patch mitigates this by introducing a checkOwner method that is called before performing any sensitive operation. This new method verifies that the identity of the caller matches the owner of the resource, thus preventing the IDOR vulnerability.
