Low severity2.7NVD Advisory· Published Feb 2, 2026· Updated Apr 15, 2026
CVE-2025-13881
CVE-2025-13881
Description
A flaw was found in Keycloak Admin API. This vulnerability allows an administrator with limited privileges to retrieve sensitive custom attributes via the /unmanagedAttributes endpoint, bypassing User Profile visibility settings.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
org.keycloak:keycloak-servicesMaven | >= 26.5.0, < 26.5.2 | 26.5.2 |
org.keycloak:keycloak-servicesMaven | < 26.4.9 | 26.4.9 |
Affected products
1Patches
Vulnerability mechanics
References
10- github.com/advisories/GHSA-g78x-7vwx-9f58ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2025-13881ghsaADVISORY
- access.redhat.com/errata/RHSA-2026:2365nvdWEB
- access.redhat.com/errata/RHSA-2026:2366nvdWEB
- access.redhat.com/security/cve/CVE-2025-13881nvdWEB
- bugzilla.redhat.com/show_bug.cginvdWEB
- github.com/keycloak/keycloak/commit/1d7ab8d5fb1403902f5152820a8fc734d38b08d2ghsaWEB
- github.com/keycloak/keycloak/commit/c5c83d6604d4c73139f38fce3ed7b7c4c38c09f2ghsaWEB
- github.com/keycloak/keycloak/issues/45873ghsaWEB
- github.com/keycloak/keycloak/pull/45427ghsaWEB
News mentions
0No linked articles in our index yet.