An authenticated client can exploit an Insecure Direct Object Reference vulnerability in Keycloak’s Authorization Services Protection API. By learning or guessing another resource server’s unique identifier (UUID) within the same realm, the client bypasses normal authorization checks and can retrieve, modify, or delete that resource. The flaw leads to unauthorized information disclosure and data alteration, compromising confidentiality and integrity of resources that the client should not be able to access.

The vulnerability affects Red Hat Build of Keycloak. No specific affected version range is documented in the available data, so all deployments of this product could potentially be impacted until an official fix is released by Red Hat.

The CVSS score of 6.8 indicates a moderate severity, and the EPSS score is not reported, so the likelihood of widespread exploitation is unclear. Because the flaw requires an authenticated client that knows or discovers a resource UUID, the threat is most acute in environments where clients have broad read/write permissions or where resources are enumerated. The vulnerability is not listed in the CISA KEV catalog, suggesting it has not yet been exploited in the wild or at a large scale. Red Hat has stated that no workaround meets its security criteria, so organizations should consult Red Hat support for guidance and keep an eye out for an official patch.