← Database

CVE-2025-13881

LOW CVSS: 2.7 Published: 2026-02-02 Modified: 2026-06-17

Description

A flaw was found in Keycloak Admin API. This vulnerability allows an administrator with limited privileges to retrieve sensitive custom attributes via the /unmanagedAttributes endpoint, bypassing User Profile visibility settings.

Affected Platforms

Unknown

Weakness Type

CWE-266

References