CVE-2025-14777

A flaw was found in Keycloak. An IDOR (Broken Access Control) vulnerability exists in the admin API endpoints for authorization resource management, specifically in ResourceSetService and PermissionTicketService. The system checks authorization against the resourceServer (client) ID provided in the API request, but the backend database lookup and modification operations (findById, delete) only use the resourceId. This mismatch allows an authenticated attacker with fine-grained admin permissions for one client (e.g., Client A) to delete or update resources belonging to another client (Client B) within the same realm by supplying a valid resource ID.

• CWE-289

• https://access.redhat.com/errata/RHSA-2026:6477
• https://access.redhat.com/errata/RHSA-2026:6478
• https://access.redhat.com/security/cve/CVE-2025-14777
• https://bugzilla.redhat.com/show_bug.cgi?id=2422596

Published

Dec 16, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-1477An issue has been discovered in GitLab CE/EE affecting all v…7.5
• CVE-2025-14770The Shipping Rate By Cities plugin for WordPress is vulnerab…7.5
• CVE-2025-14771Files or directories accessible to external parties vulnerab…9.9
• CVE-2025-14772Authorization bypass through User-Controlled key vulnerabili…8.8
• CVE-2025-14773Improper neutralization of input during web page generation …5.4
• CVE-2025-14774Incorrect Authorization vulnerability in ABB T-MAC Plus. Th…7.4
• CVE-2025-14778A flaw was found in Keycloak. A significant Broken Access Co…5.4
• CVE-2025-14779The Secret Type Management REST API does not correctly isola…3.8
• CVE-2025-1478An issue has been discovered in GitLab CE/EE affecting all v…7.5
• CVE-2025-14780A vulnerability was detected in Xiongwei Smart Catering Clou…6.3
• CVE-2025-14782The Forminator Forms – Contact Form, Payment Form & Custom F…5.3
• CVE-2025-14783The Easy Digital Downloads plugin for WordPress is vulnerabl…4.3