CVE-2026-18201 Details

A vulnerability exists in Keycloak's administrative API, specifically within the generic identity-provider creation endpoint. This flaw allows an administrator with permissions to manage identity providers to link a new provider to an organization without having the necessary permissions to manage that organization. As a result, an unauthorized administrator could potentially influence how users log into certain organizations. The issue arises from a missing authorization check, which fails to validate whether the administrator has the right to manage the specified organization.