CVE-2026-14614

A flaw was found in the ClientResource component of Keycloak's admin services when Fine-Grained Admin Permissions (FGAP) v2 is enabled. This issue allows a delegated administrator, who should only have limited control over specific clients, to attach or remove hidden client scopes that they are not authorized to see or manage. As a result, an attacker could inject unauthorized data or permissions into the security tokens issued to end-users, potentially tricking other applications into granting higher levels of access than intended.

• CWE-284

• https://access.redhat.com/security/cve/CVE-2026-14614
• https://bugzilla.redhat.com/show_bug.cgi?id=2496889

Published

Jul 3, 2026

Last Modified

Jul 6, 2026

Status

Awaiting Analysis

• CVE-2026-14609A vulnerability was detected in SourceCodester CET Automated…5.6
• CVE-2026-1461The Simple Membership plugin for WordPress is vulnerable to …6.5
• CVE-2026-14610A flaw has been found in Open Asset Import Library Assimp up…5.3
• CVE-2026-14611A vulnerability has been found in DeepMyst Mysti up to 0.4.0…5.3
• CVE-2026-14612Two off-by-one errors in the FreeIPA ipa-otpd daemon's OAuth…4.2
• CVE-2026-14613A vulnerability was discovered in Keycloak's administrative …4.3
• CVE-2026-14615A flaw was found in the Fine-Grained Admin Permissions (FGAP…4.3
• CVE-2026-14617A security vulnerability has been detected in NousResearch h…3.1
• CVE-2026-14618A vulnerability was detected in Open5GS up to 2.7.7. Affecte…4.3
• CVE-2026-14619A flaw has been found in itsourcecode Hospital Management Sy…6.3
• CVE-2026-1462A vulnerability in the `TFSMLayer` class of the `keras` pack…8.8
• CVE-2026-14620webpack-dev-server versions 5.2.5 and earlier expose two int…4.7