Keycloak’s administrative API allows an administrator with permission to create identity providers to associate a newly created provider with an organization they do not have manage‑organization rights over. This flaw can let an unauthorized administrator influence how members of that organization authenticate, altering the identity‑provider binding without proper authorization approval.

Red Hat Build of Keycloak, Red Hat Data Grid 8, Red Hat JBoss Enterprise Application Platform Expansion Pack, Red Hat Single Sign-On 7. Version information is not provided.

The CVSS score of 5.5 indicates moderate severity, and the EPSS score of less than 1% shows very low likelihood of exploitation currently. The vulnerability is not listed in the CISA KEV catalog, and no public exploits are reported. Based on the description, it is inferred that an attacker needs administrative access to the Keycloak instance with permissions to create identity providers, making it a privilege‑oriented attack limited to systems with exposed administrative APIs.