CVE-2026-12388 Details

A privilege escalation vulnerability has been identified in the Identity Provider (IdP) mapper component of Keycloak. This component manages the mapping of user information from external services to Keycloak users. The flaw allows an administrator with limited permissions to manage identity providers to create a 'Hardcoded Role' mapper that assigns high-level administrative roles, such as realm-admin, to themselves or others. This exploitation enables the administrator to bypass security checks and gain full control over the Keycloak realm.