VulnSocial

CVE-2026-94001Disclosure

LOWCVSS 6.5 · MEDIUM

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

A flaw was found in the Admin REST API of Keycloak, an open-source identity and access management solution. The endpoint used for deleting user credentials does not correctly check for fine-grained reset-password permissions. This allows a delegated administrator, who should be restricted from resetting passwords, to delete a user's password credentials, resulting in the user being unable to log in.

Back to dashboard
0.5/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-862

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

  • Patch or workaround signal is available
  • 2 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 1 signal
  • Disclosure: 1 classified signal
  • Peaked 1d ago at 1 mentions (2026-09-19); latest day: 1
  • 2 total mentions across 2 days

Deep dive

Activity timeline2 mentions / 2d
00111Mentions · 2026-09-19: 1Mentions · 2026-10-26: 1Patch / Workaround · 2026-10-26: 1Technical Details · 2026-10-26: 109-1910-26
Signal classification2 categories
Disclosure
150.0%
Patch
150.0%
Referenced assets2 URLs
Classification over time
DateTotalLabels
2026-09-191
Disclosure1
2026-10-261
Patch1
Full discourse2 posts
  • Hugo | DevOps | Cybersecurity@HugoValters
    Patch

    CVE-2026-94001 Keycloak Admin REST API: missing permission check lets delegated admins delete user password credentials, locking users out. CVSS 6.5, unpatched. Restrict admin roles now. #CVE #infosec #Keycloak https://www.valtersit.com/cve/CVE-2026-94001 #Keycloak #CVEALERT #CVE #infosec #Linux #XSS #valtersit #snippet #SysAdmin #cybersecurity #devsecops #devops #developer #100daysofcode #git #github #gitlab #redteam #blueteam #ethicalhacker #cybersecurityawareness #cybersecuritynews #cybersecuritytips #python #hacker #kali #ubuntu #debian #docker

    Post summary

    The tweet discloses CVE-2026-94001 in Keycloak, detailing a missing permission check allowing delegated admins to lock out users (CVSS 6.5), explicitly notes the vulnerability is unpatched, and advises restricting admin roles as an immediate workaround.

    0000034
    1.1K followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2026-94001 A flaw was found in the Admin REST API of Keycloak, an open-source identity and access management solution. The endpoint used for deleting user credentials does not c… https://www.cve.org/CVERecord?id=CVE-2026-94001

    Post summary

    The post announces CVE-2026-94001, a flaw in Keycloak's Admin REST API related to the user credentials deletion endpoint, but provides no technical details, exploit references, patch information, or evidence of active exploitation in the wild.

    000001.4K
    58.1K followersView on X

Explore more

Back to dashboard