Skip to content

[CVE-2026-16105] Missing per-role authorization on RoleContainerResou… - #51611

Open
martin-kanis wants to merge 1 commit into
keycloak:release/26.7from
martin-kanis:51002-backport-26.7
Open

[CVE-2026-16105] Missing per-role authorization on RoleContainerResou…#51611
martin-kanis wants to merge 1 commit into
keycloak:release/26.7from
martin-kanis:51002-backport-26.7

Conversation

@martin-kanis

@martin-kanis martin-kanis commented Aug 11, 2026

Copy link
Copy Markdown
Contributor

…rce composite endpoints

Closes #51002

Signed-off-by: Martin Kanis mkanis@ibm.com

(cherry picked from commit 81ada68)

@martin-kanis
[CVE-2026-16105] Missing per-role authorization on RoleContainerResou…
48c64b2 
…rce composite endpoints

Closes keycloak#51002

Signed-off-by: Martin Kanis <mkanis@ibm.com>

(cherry picked from commit 81ada68)
@martin-kanis
martin-kanis requested a review from a team as a code owner August 11, 2026 09:23
@keycloak-github-bot

keycloak-github-bot Bot commented Aug 11, 2026

Copy link
Copy Markdown

Unreported flaky test detected

If the flaky tests below are affected by the changes, please review and update the changes accordingly. Otherwise, a maintainer should report the flaky tests prior to merging the PR.

org.keycloak.testsuite.oauth.ClientAuthPostMethodTest#testPostAuthenticationNotAllowedWhenBasicRequested

Keycloak CI - Base IT (6)

java.lang.NullPointerException: Cannot read field "features" because the return value of "org.keycloak.common.Profile.getInstance()" is null
	at org.keycloak.common.Profile.isFeatureEnabled(Profile.java:532)
	at org.keycloak.protocol.oidc.OIDCClientSecretConfigWrapper.<init>(OIDCClientSecretConfigWrapper.java:41)
	at org.keycloak.protocol.oidc.OIDCClientSecretConfigWrapper.fromClientRepresentation(OIDCClientSecretConfigWrapper.java:49)
	at org.keycloak.testsuite.oauth.ClientAuthPostMethodTest.testPostAuthenticationNotAllowedWhenBasicRequested(ClientAuthPostMethodTest.java:141)
...

Report flaky test

org.keycloak.testsuite.oauth.ClientAuthPostMethodTest#testBasicAuthenticationNotAllowedWhenPostRequested

Keycloak CI - Base IT (6)

java.lang.NullPointerException: Cannot read field "features" because the return value of "org.keycloak.common.Profile.getInstance()" is null
	at org.keycloak.common.Profile.isFeatureEnabled(Profile.java:532)
	at org.keycloak.protocol.oidc.OIDCClientSecretConfigWrapper.<init>(OIDCClientSecretConfigWrapper.java:41)
	at org.keycloak.protocol.oidc.OIDCClientSecretConfigWrapper.fromClientRepresentation(OIDCClientSecretConfigWrapper.java:49)
	at org.keycloak.testsuite.oauth.ClientAuthPostMethodTest.testBasicAuthenticationNotAllowedWhenPostRequested(ClientAuthPostMethodTest.java:112)
...

Report flaky test

keycloak-github-bot[bot]
keycloak-github-bot Bot reviewed Aug 11, 2026
View reviewed changes

@keycloak-github-bot keycloak-github-bot Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Unreported flaky test detected, please review

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@pedroigor pedroigor pedroigor approved these changes
+1 more reviewer
@keycloak-github-bot keycloak-github-bot[bot] keycloak-github-bot[bot] left review comments
Reviewers whose approvals may not affect merge requirements

Assignees

No one assigned

Labels

flaky-test team/core-iam

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@martin-kanis @pedroigor