CVE-2026-16108 — MEDIUM (4.3)

Vulnerability Description

A flaw was found in the default-groups REST endpoint and realm representation of Keycloak. This component is responsible for managing groups that are automatically assigned to new users within a realm. The issue allows a delegated administrator with realm-viewing permissions to see the names and identifiers of hidden default groups, even if they lack the specific permissions to view those groups. This can lead to the exposure of sensitive organizational structures or internal group names.

CVSS Score

4.3

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

LOW

Integrity

NONE

Availability

NONE

Affected Products

Vendor	Product	Versions
Redhat	Build Of Keycloak	-

Related Weaknesses (CWE)

CWE-200

References

https://access.redhat.com/security/cve/CVE-2026-16108Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2501740Issue TrackingVendor Advisory

FAQ

What is CVE-2026-16108?

CVE-2026-16108 is a vulnerability with a CVSS score of 4.3 (MEDIUM). A flaw was found in the default-groups REST endpoint and realm representation of Keycloak. This component is responsible for managing groups that are automatically assigned to new users within a realm...

How severe is CVE-2026-16108?

CVE-2026-16108 has been rated MEDIUM with a CVSS base score of 4.3/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2026-16108?

Check the references section above for vendor advisories and patch information. Affected products include: Redhat Build Of Keycloak.