ZeroDay Findings
Sign inSign up

Findings

CVE-2026-37981

A flaw was found in Keycloak.

Published May 19, 2026 · updated Jun 17, 2026 · redhat build of keycloak

A flaw was found in Keycloak. A broken access control vulnerability in the Account Resources user lookup endpoint allows a remote authenticated user, who owns at least one User-Managed Access (UMA) resource, to enumerate and harvest personally identifiable information (PII) for all realm users. By sending crafted requests with arbitrary usernames or email values, the endpoint returns full profile objects for unrelated users. This leads to broad profile-level information disclosure.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

  1. May 19, 2026 · NIST NVD

    Detected

    A flaw was found in Keycloak. A broken access control vulnerability in the Account Resources user lookup endpoint allows a remote authenticated user, who owns at least one User-Managed Access (UMA) resource, to enumerate and harvest personally identifiable information (PII) for all realm users. By sending crafted requests with arbitrary usernames or email values, the endpoint returns full profile

  2. Jun 17, 2026 · NIST NVD

    Updated

    A flaw was found in Keycloak. A broken access control vulnerability in the Account Resources user lookup endpoint allows a remote authenticated user, who owns at least one User-Managed Access (UMA) resource, to enumerate and harvest personally identifiable information (PII) for all realm users. By sending crafted requests with arbitrary usernames or email values, the endpoint returns full profile

Affected

  • cpe redhat/build of keycloakversion unspecified

Sources

  • CVE.orgVulnerability recordCVE-2026-37981

    Official CVE identifier

    cve.org
  • NIST NVDVulnerability recordCVE-2026-37981

    A flaw was found in Keycloak. A broken access control vulnerability in the Account Resources user lookup endpoint allows a remote authenticated user, who owns at least one User-Managed Access (UMA) resource, to enumerate and harvest personally identifiable information (PII) for a

    nvd.nist.gov

References

CVE-2026-37981 · ZeroDay Findings