Junglewise Threat Intelligence
CVE-2026-3190: Keycloak: Missing Role Enforcement on UMA 2.0 Permission Ticket Endpoint Leads to Information Disclosure
CVE-2026-3190 · Severity: low · CVSS 3.1 · Published 2026-03-26
Technologies: org.keycloak:keycloak-server-spi-private (Maven), org.keycloak:keycloak-model-jpa (Maven), org.keycloak:keycloak-services (Maven). Vendors: Maven.
Executive brief
Keycloak: Missing Role Enforcement on UMA 2.0 Permission Ticket Endpoint Leads to Information Disclosure
Affected products
- Maven org.keycloak:keycloak-server-spi-private
- Maven org.keycloak:keycloak-model-jpa
- Maven org.keycloak:keycloak-services