CVE-2025-14777 — Katalog CVE

csirt@kutim:~/threat-intel/cve/CVE-2025-14777

CVSS 6.0 · Medium EPSS 0,35%

Kerentanan Authentication Bypass by Alternate Name. Skor CVSS 3.1 6.0 (Medium) menurut redhat.com.

Deskripsi (NVD)

A flaw was found in Keycloak. An IDOR (Broken Access Control) vulnerability exists in the admin API endpoints for authorization resource management, specifically in ResourceSetService and PermissionTicketService. The system checks authorization against the resourceServer (client) ID provided in the API request, but the backend database lookup and modification operations (findById, delete) only use the resourceId. This mismatch allows an authenticated attacker with fine-grained admin permissions for one client (e.g., Client A) to delete or update resources belonging to another client (Client B) within the same realm by supplying a valid resource ID.

Rincian

Terbit di NVD: 16 Desember 2025
Terakhir diubah: 7 Oktober 2026
Status NVD: Deferred
CVSS 3.1: 6.0 (Medium), sumber redhat.com
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:L · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-289: Authentication Bypass by Alternate Name
EPSS (30 hari): 0,35% peluang dieksploitasi; lebih tinggi dari 26,1% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 8 Okt 2026, 06:25 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.