Keycloak vulnerabilities

A flaw in the Micrometer user-event metrics listener of Keycloak occurs when the listener is configured to include the idp tag. An unauthenticated attacker can send requests to the identity broker login endpoint using arbitrary provider aliases, causing the system to create an unlimited number of metric time series, leading to excessive memory consumption and degraded performance of the server and monitoring tools.

A flaw was found in the first-broker-login flow of the keycloak-services component. It allows an attacker to register a matching username on an external identity provider, causing a collision in Keycloak and locking out the legitimate user.

Keycloak is an open-source identity and access management solution. A vulnerability was discovered where a user with the impersonation role can impersonate a realm administrator, gaining full administrative control over the realm, including the ability to manage users, clients, and roles.

A flaw was found in the theme localization endpoints of the keycloak-services component, which is the core service responsible for authentication flows and theme management in Keycloak. The issue occurs because the system accepts arbitrary locale tags from unauthenticated requests and stores them in a permanent in-memory cache without limits. An attacker can exploit this by sending a large number of unique locale tags, eventually causing the server to run out of memory and crash.

A flaw was found in the SAML Redirect Binding implementation of Keycloak where the custom DEFLATE compression and decompression helpers fail to release native zlib memory after use. An unauthenticated attacker can exploit this by sending repeated malformed SAML requests, leading to native memory exhaustion and a denial of service.

A flaw was found in the group policy provider of Keycloak authorization services, which is used to manage fine-grained access control to resources. The issue occurs when the system evaluates group-based policies using tokens that only contain group names rather than full paths. If two groups in different parts of the organization share the same name, a user in the unauthorized group can be mistaken for a member of the authorized group. This can allow a user to gain unauthorized access to protected resources they should not be able to reach.

A flaw was found in Keycloak regarding the authorization header parser. This parser is overly permissive regarding the formatting of the 'Bearer' authentication scheme, accepting non-standard characters as separators and tolerating case variations that deviate from RFC 6750 specifications.

It was found that the cookie used for CSRF prevention in Keycloak was not unique to each session. An attacker could use this flaw to gain access to an authenticated user session, leading to possible information disclosure or further attacks.

A flaw was found in the Client-Initiated Backchannel Authentication (CIBA) implementation within the keycloak-services component of Keycloak. Keycloak fails to verify that a client is authorized to use the CIBA flow, allowing public clients to bypass security requirements. An attacker could trick a user into approving a login request, eventually gaining full access to the user's account without needing a client secret.

A flaw in the login theme rendering component of Keycloak. The security filter responsible for cleaning user input can be bypassed, allowing a realm administrator to store malicious scripts in display fields. This could result in unauthorized JavaScript execution in the browsers of users visiting the login page.

A flaw in the OIDC Dynamic Client Registration (DCR) component of Keycloak causes the backchannel logout offline token revocation setting to be omitted from responses. When a client performs a standard update, this missing information causes the setting to be silently disabled. As a result, offline tokens may remain valid even after a user session is terminated via backchannel logout.

A flaw in the installation provider and client registration endpoints of Keycloak allows a realm administrator with only the read-only view-clients role to access the active primary secret of any confidential client, which should normally be restricted. This exposed secret can be used to impersonate the client and gain unauthorized access to its associated service account permissions.

A flaw in the SMTP email configuration handling of the keycloak-services component. When STARTTLS is enabled, Keycloak fails to strictly enforce an encrypted connection, allowing fallback to unencrypted communication if the encryption request is tampered with. An attacker who can intercept network traffic could capture sensitive email credentials and message content in plain text.

In the OIDC implementation of Keycloak, specifically in the Device Authorization Grant flow, the minimum authentication level required by a client configuration is not checked. This allows an attacker who has stolen a user's password to bypass mandatory multi-factor authentication and gain unauthorized access to the Keycloak Admin REST API.

A flaw was found in the Dynamic Client Registration flow of the Keycloak identity and access management server. The registration process fails to filter security-sensitive client attributes when a new client is created. An attacker with a valid Initial Access Token can register a client that bypasses audience checks during token introspection, allowing them to view sensitive identity information, roles, and session details from access tokens belonging to other applications in the same realm.

A flaw was found in the User Session Note mapper of the Keycloak identity and access management solution. The mapper does not validate whether a requested session note contains sensitive internal credentials, such as federated access tokens from external identity providers. This allows a delegated client administrator to leak a user's upstream bearer tokens into the tokens issued to their managed application.

A flaw was found in the X.509 client-certificate authenticator of Keycloak. The issue occurs when the server is configured to check certificate revocation using CRL Distribution Points or OCSP. An attacker can provide a specially crafted certificate that points to a malicious server, causing Keycloak to make unauthorized outbound requests to internal or external endpoints before the certificate is fully validated.

A flaw was found in the X.509 client certificate authenticator of Keycloak. When CRL Distribution Point checking is enabled, the server fails to properly validate the file paths provided in a client certificate. An attacker can provide a specially crafted certificate that causes the server to attempt to read sensitive files from the local system or exhaust memory by loading extremely large files, potentially leading to information disclosure or a system crash.

A flaw in the Fine-Grained Admin Permissions (FGAP v2) feature of Keycloak occurs because the system does not inspect composite roles when checking whether a delegated administrator may assign a specific role. An administrator with limited rights can assign a role that secretly includes full administrative control.

Keycloak's mTLS holder-of-key binding ensures a token can only be used by the client that requested it by binding it to their certificate. The new Standard Token Exchange V2 feature does not check for this certificate, allowing an attacker with stolen client credentials to obtain a standard, unrestricted token.

A flaw was found in the Admin REST API of Keycloak, an identity and access management solution. The endpoints used to retrieve groups associated with a specific role do not properly check individual group visibility permissions. This allows a delegated administrator with basic search privileges to view detailed information about all groups assigned to a role, bypassing intended security restrictions.

A flaw was found in the user update mechanism of the Keycloak Admin REST API. When Fine-Grained Admin Permissions are enabled, the system fails to check for specific password reset authorizations during a general user profile update. This allows a delegated administrator, who should be restricted from resetting passwords, to change a user's credentials and take over their account.

A flaw was found in the Level of Authentication enforcement mechanism of Keycloak. The issue occurs when a client specifically requires a higher security level for a user who already has an active session at a lower level. Due to a logic error in how session re-evaluations are handled, Keycloak may incorrectly issue a token at the lower security level instead of enforcing the required higher level, potentially allowing unauthorized access to sensitive resources that rely on these security claims.

Vulnerability in Keycloak's Pushed Authorization Request (PAR) implementation. When silent authentication (prompt=none) is used, the authorization process skips certain steps, failing to enforce that a pushed request URI is used only once. An attacker can reuse the URI to obtain multiple authorization codes for a logged-in user, violating security standards like FAPI-2.

Vulnerability in Keycloak's Conditional OTP authenticator. The system evaluates specific HTTP headers to decide whether to skip OTP but does not verify if those headers are from a trusted source. An attacker with the user's password can bypass second-factor authentication by providing a crafted header.

A flaw was found in the Kerberos federation provider of Keycloak. When Kerberos password authentication is used without SPNEGO, the system fails to verify the identity of the Key Distribution Center (KDC), allowing an attacker on the same network to spoof the KDC and bypass authentication.

A flaw was found in the authentication session management of Keycloak. When an administrator enforces a stronger authentication flow, such as mandatory 2FA setup, a user can bypass this requirement by manually visiting a specific session restart web link during login. This clears internal markers tracking required security steps, allowing login with only a password.

A flaw was found in the User-Managed Access (UMA) implementation of Keycloak. In the authorization token endpoint, when processing permission tickets, if two different users own resources with the same name, the system incorrectly merges permissions from both resources. This allows an attacker to gain access scopes on a victim's resource that were never intended to be shared.

A flaw was found in the Admin REST API of Keycloak. The issue occurs because the API uses a per-request in-memory cache to resolve clients by their unique identifier without verifying if the client belongs to the realm specified in the request path. This allows an administrator with limited privileges to read or modify sensitive client configurations in the master realm by accessing them through a realm they control.

A flaw was found in the Authorization Services component of Keycloak. The issue occurs in the policy evaluation endpoint, which is used by administrators to test how access policies apply to specific users. Due to missing authorization checks, a delegated administrator with limited viewing privileges can access the full profile and role information of any user in the realm, even if they are not permitted to view user details.

A flaw was found in the Admin REST API of Keycloak, an open-source identity and access management solution. The endpoint used for deleting user credentials does not correctly check for fine-grained reset-password permissions. This allows a delegated administrator, who should be restricted from resetting passwords, to delete a user's password credentials, resulting in the user being unable to log in.

A flaw was found in the Admin REST API of Keycloak, an open-source identity and access management solution. The issue occurs in the group-membership endpoints where the system fails to check if a group grants administrative privileges before allowing a user to be added. This allows a delegated administrator with limited permissions to add themselves to a high-privilege group, potentially gaining full control over the entire realm.

A flaw was found in the OIDC protocol implementation of Keycloak, an open-source identity and access management solution. The issue occurs during the token refresh process when the server restores requested audiences from stored client IDs. Keycloak fails to verify if the target audience client is still enabled before issuing a new access token. This allows an application with an existing refresh token to continue obtaining valid access tokens for a disabled client, potentially bypassing administrative access controls for resource servers that rely on offline JWT validation.

In Keycloak deployed in stateless mode with MySQL or MariaDB, a mismatch in row-count semantics between the database driver and Keycloak's application logic allows an attacker to bypass replay protection. This vulnerability enables an attacker who intercepts single-use security artifacts, such as JWT client assertions, DPoP proofs, or one-time password (TOTP) codes, to replay them. Successful exploitation grants unauthorized access to the token endpoint or login flow.

Keycloak's policy enforcer fails to correctly normalize web addresses containing special encoded characters, such as those representing semicolons or directory traversal segments. An authenticated user can use these encoded characters to trick the enforcer into applying a less restrictive security policy than intended, potentially gaining unauthorized access to sensitive administrative or private application endpoints.

A flaw was found in the first broker login flow of Keycloak. When a user confirms an account-linking request from a different browser, a temporary proof is created to validate the link. However, this proof is not properly cleared after the link is established or when the user later manually removes the link. An attacker who controls the external identity can exploit this leftover proof to silently re-establish the link and gain unauthorized access to the victim's account without any further confirmation.

A flaw was found in the Dynamic Client Registration service of Keycloak. When a user with the view-clients role accesses the client registration endpoint to retrieve client details, the service returns the client's confidential secret in cleartext due to a failure to mask sensitive information.

A flaw in the Device Authorization Grant flow of Keycloak occurs because the token redemption process fails to check whether a user account is currently locked due to brute-force protection. If an attacker has an active session for a locked account, they can complete the device login process and receive new security tokens.

A flaw was found in the first-broker-login flow of the Keycloak identity management service. When a user links a social identity provider account to their local account, the verification proof generated is not strictly bound to the specific upstream identity being verified. This allows an attacker with a different account on the same social provider to intercept the process and link their own account to the victim's local profile, gaining unauthorized access.

A flaw was found in the JWT Bearer authorization grant implementation within the keycloak-services component of Red Hat Build of Keycloak. The grant fails to check if a client requires user consent before issuing a token. This allows an authenticated attacker with valid client credentials and a trusted identity provider assertion to bypass the consent requirement and obtain unauthorized access to a user account at a consent-gated client.

Keycloak contains a vulnerability in the legacy account-linking endpoint, where the protection mechanism based on a hash can be predicted by a malicious OIDC client. An attacker can forge a linking URL to connect the victim's account to an attacker-controlled external identity, leading to full account takeover.

In the SAML broker component of Keycloak, when configured with IdP-Initiated flow, the OneTimeUse condition in SAML assertions is not enforced. This allows an attacker who captures a valid, unused assertion to replay it multiple times, potentially hijacking a user's session.

A flaw in the SAML broker component of Keycloak, used for identity federation and user authentication. The IdP-initiated Single Sign-On endpoint fails to check if a provider is restricted to account linking only, allowing an attacker with control over a linked upstream identity to bypass login restrictions and gain full access to a local user account.

A flaw in Keycloak's Dynamic Client Registration (DCR) security policy management. The "Allowed Protocol Mapper Types" policy fails to re-validate the mapper type during a client update if the mapper's configuration remains unchanged. An attacker with client registration privileges can register an allowed mapper type with malicious configuration and then swap it for a restricted, high-privilege mapper type, gaining full administrative access to the realm.

A flaw in the Dynamic Client Registration (DCR) component of Keycloak. The default DCR policy fails to properly validate the claim path for User Property mappers, allowing them to write values to sensitive internal claim locations. An attacker with a standard user account and a limited Initial Access Token can forge administrative roles in their access token, leading to takeover of other clients, theft of confidential secrets, and potential full administrative control over the realm.

A flaw was found in the user-event metrics recording of Keycloak. When metrics are enabled, the system records raw error messages from failed account operations as Prometheus metric labels. Because these error messages can include user-supplied input like nonexistent client IDs, an authenticated user can create a massive number of unique metric entries, eventually exhausting system memory and causing the service to crash or become unavailable.

A flaw was found in the LDAP storage provider of Keycloak, used to federate user identities from external directories. The issue occurs when a delegated administrator performs a search using a specific LDAP entry Distinguished Name (DN). Due to missing validation, the system allows lookups for users located outside the configured search boundary, leading to the disclosure of account information from unauthorized parts of the directory and unintended importing of those users into local storage.

A flaw in Keycloak's Authorization Services. The PathMatcher component does not properly normalize URIs before comparison. By adding extra characters like a trailing slash or matrix parameters, an attacker can trick the system into applying a less restrictive security policy, allowing an authenticated user to access administrative or restricted areas they should not have permission to see.

A flaw was found in the SAML metadata import functionality of the keycloak-services component, which incorrectly disables signature validation for SAML responses when identity provider metadata lacks specific usage attributes for keys. This allows an unauthenticated attacker to forge a SAML response and gain unauthorized access to a user account by knowing their external identifier.

A flaw in the backchannel logout endpoint of the keycloak-services component (part of Red Hat Build of Keycloak) allows the system to incorrectly accept logout requests without a cryptographic signature when an OIDC identity provider is configured to skip signature validation. An attacker knowing session details can force a user to be logged out.