Executive brief
Keycloak Server Private SPI: Improper Access Control Allows Administrators to Bypass Attribute Visibility Restrictions and Modify Unmanaged User Profile Attributes
Affected products
- Maven org.keycloak:keycloak-server-spi-private
Junglewise Threat Intelligence
CVE-2026-0871: Keycloak Server Private SPI: Improper Access Control Allows Administrators to Bypass Attribute Visibility Restrictions and Modify Unmanaged
CVE-2026-0871 · Severity: low · CVSS 3.1 · Published 2026-02-27
Technologies: org.keycloak:keycloak-server-spi-private (Maven). Vendors: Maven.
Related threats
- Keycloak privilege escalation via oversized subject_token JWT
- Keycloak: Missing Role Enforcement on UMA 2.0 Permission Ticket Endpoint Leads to Information Disclosure
- Keycloak SAML broker authentication bypass via disabled Identity Provider
- Client Spoofing within the Keycloak Device Authorisation Grant
- Cross-site Scripting in keycloak