Cyber Resilience

CVE-2026-7500

Redhat Build Of Keycloak

Published
30 April 2026
Modified
26 June 2026
Patch / advisory
View advisory
CVSS Score v3.1 5.4
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
EPSS Score 0.0023 14th percentile
Risk Priority 35 floored blend · peak EPSS

Summary

CVE-2026-7500 is a medium-severity Forced Browsing (CWE-425) vulnerability in Redhat Build Of Keycloak. Its CVSS base score is 5.4 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 14th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and CM-7 (Least Functionality) — see the control section below for these in your framework.

OWASP Top 10 for Web (2025)

A01:2025 Broken Access Control

EU & UK References

Vulnerability Data

When Keycloak is started with `--features-disabled=account,account-api`, the Account REST API is only partially disabled. Five endpoints under the versioned path `/account/v1alpha1` remain fully functional — including both read and write operations — because they lack the `checkAccountApiEnabled()` gate that correctly…

more

blocks four other endpoints in the same REST service class. The user needs to have permissions to use the API.

CWE(s)
CWE-425NVD-CWE-noinfo

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
Why these techniques?

Bypass of intended API disablement in public-facing Keycloak server allows access to restricted account endpoints (CWE-425).

Confidence: MEDIUM · MITRE ATT&CK Enterprise v19.0

Likely ATT&CK TechniquesAI

Techniques this vulnerability likely enables, inferred from its description, weakness type, and attributed-actor tradecraft. Confidence is per-technique.

T1190 Exploit Public-Facing Application Initial Accessconfidence: HIGH
Missing gate on five /account/v1alpha1 endpoints allows an attacker to reach and use read/write REST functionality that the feature flag was intended to disable.
attack.mitre.org →
inferred from description + CWE · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2026-4628Same product: Redhat Build Of Keycloak
CVE-2026-9792Same product: Redhat Build Of Keycloak
CVE-2026-4630Same product: Redhat Build Of Keycloak
CVE-2026-37977Same product: Redhat Build Of Keycloak
CVE-2026-9689Same product: Redhat Build Of Keycloak
CVE-2026-37979Same product: Redhat Build Of Keycloak
CVE-2026-9793Same product: Redhat Build Of Keycloak
CVE-2026-4282Same product: Redhat Build Of Keycloak
CVE-2026-9087Same product: Redhat Build Of Keycloak
CVE-2026-9705Same product: Redhat Build Of Keycloak

Affected Assets

redhat
build of keycloak
all versions

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)
  • AC-3 Access Enforcement
  • CM-7 Least Functionality
Detect
Catch it (NIST detect / respond)
  • SI-2 Flaw Remediation
Harden
Shrink the surface (DISA STIG)

—

Validate
Prove the fix (OWASP ASVS)

—

Mitigating Controls (NIST 800-53 r5) AI

AC-3 Access Enforcement good match
prevent

Directly supplies the missing checkAccountApiEnabled() gate that must enforce the --features-disabled setting on every /account/v1alpha1 endpoint.

CM-7 Least Functionality good match
prevent

Least-functionality configuration that disables the account-api feature must be applied uniformly to all code paths, which the CVE shows was not done.

SI-2 Flaw Remediation partial match
respond

Requires prompt remediation of the incomplete feature-disable logic so that the five unprotected endpoints are removed or correctly gated.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.AA-05 full match
prevents

Directly requires policy-driven definition, enforcement, and review of authorizations on resources such as URLs.

PR.IR-01 mostly match
prevents

Protects environments from unauthorized logical access, which includes preventing direct requests to restricted paths.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.8.29 Security testing in development and acceptance mostly match
detects

Security testing can detect forced-browsing flaws, but the control itself does not prevent them in production.

A.8.3 Information access restriction mostly match
prevents

Information access restriction implements the technical enforcement that directly blocks unauthorized direct requests.

A.5.15 Access control partial match
prevents

Access control policy directly requires authorization checks on all resources, preventing forced browsing.

A.5.18 Access rights partial match
degrades

Managing access rights ensures every URL/script/file is explicitly authorized, mitigating direct request attacks.

A.8.2 Privileged access rights partial match
degrades

Privileged access rights control enforces least-privilege checks on restricted endpoints.

A.8.25 Secure development life cycle partial match
prevents

Secure SDLC can include authorization design, yet the control itself does not guarantee runtime enforcement.

References