Keycloak vulnerabilities

A flaw was found in the group policy provider of Keycloak authorization services, which is used to manage fine-grained access control to resources. The issue occurs when the system evaluates group-based policies using tokens that only contain group names rather than full paths. If two groups in different parts of the organization share the same name, a user in the unauthorized group can be mistaken for a member of the authorized group. This can allow a user to gain unauthorized access to protected resources they should not be able to reach.

A flaw was found in Keycloak regarding the authorization header parser. This parser is overly permissive regarding the formatting of the 'Bearer' authentication scheme, accepting non-standard characters as separators and tolerating case variations that deviate from RFC 6750 specifications.

It was found that the cookie used for CSRF prevention in Keycloak was not unique to each session. An attacker could use this flaw to gain access to an authenticated user session, leading to possible information disclosure or further attacks.

A flaw was found in the JWT Bearer authorization grant implementation within the keycloak-services component of Red Hat Build of Keycloak. The grant fails to check if a client requires user consent before issuing a token. This allows an authenticated attacker with valid client credentials and a trusted identity provider assertion to bypass the consent requirement and obtain unauthorized access to a user account at a consent-gated client.

Keycloak contains a vulnerability in the legacy account-linking endpoint, where the protection mechanism based on a hash can be predicted by a malicious OIDC client. An attacker can forge a linking URL to connect the victim's account to an attacker-controlled external identity, leading to full account takeover.

In the SAML broker component of Keycloak, when configured with IdP-Initiated flow, the OneTimeUse condition in SAML assertions is not enforced. This allows an attacker who captures a valid, unused assertion to replay it multiple times, potentially hijacking a user's session.

A flaw in the SAML broker component of Keycloak, used for identity federation and user authentication. The IdP-initiated Single Sign-On endpoint fails to check if a provider is restricted to account linking only, allowing an attacker with control over a linked upstream identity to bypass login restrictions and gain full access to a local user account.

A flaw in Keycloak's Dynamic Client Registration (DCR) security policy management. The "Allowed Protocol Mapper Types" policy fails to re-validate the mapper type during a client update if the mapper's configuration remains unchanged. An attacker with client registration privileges can register an allowed mapper type with malicious configuration and then swap it for a restricted, high-privilege mapper type, gaining full administrative access to the realm.

A flaw in the Dynamic Client Registration (DCR) component of Keycloak. The default DCR policy fails to properly validate the claim path for User Property mappers, allowing them to write values to sensitive internal claim locations. An attacker with a standard user account and a limited Initial Access Token can forge administrative roles in their access token, leading to takeover of other clients, theft of confidential secrets, and potential full administrative control over the realm.

A flaw was found in the user-event metrics recording of Keycloak. When metrics are enabled, the system records raw error messages from failed account operations as Prometheus metric labels. Because these error messages can include user-supplied input like nonexistent client IDs, an authenticated user can create a massive number of unique metric entries, eventually exhausting system memory and causing the service to crash or become unavailable.

A flaw was found in the LDAP storage provider of Keycloak, used to federate user identities from external directories. The issue occurs when a delegated administrator performs a search using a specific LDAP entry Distinguished Name (DN). Due to missing validation, the system allows lookups for users located outside the configured search boundary, leading to the disclosure of account information from unauthorized parts of the directory and unintended importing of those users into local storage.

A flaw in Keycloak's Authorization Services. The PathMatcher component does not properly normalize URIs before comparison. By adding extra characters like a trailing slash or matrix parameters, an attacker can trick the system into applying a less restrictive security policy, allowing an authenticated user to access administrative or restricted areas they should not have permission to see.

A flaw was found in the SAML metadata import functionality of the keycloak-services component, which incorrectly disables signature validation for SAML responses when identity provider metadata lacks specific usage attributes for keys. This allows an unauthenticated attacker to forge a SAML response and gain unauthorized access to a user account by knowing their external identifier.

A flaw in the backchannel logout endpoint of the keycloak-services component (part of Red Hat Build of Keycloak) allows the system to incorrectly accept logout requests without a cryptographic signature when an OIDC identity provider is configured to skip signature validation. An attacker knowing session details can force a user to be logged out.

A flaw in the keycloak-services component of Keycloak causes improper evaluation of client state during an update operation. An attacker with client management permissions can bypass security policies by first creating a public client and then updating it to a confidential client with weaker authentication.

A flaw in Keycloak's authorization services allows a user to include a fake time value in an authorization request, overriding the actual server time. This bypasses time-based restrictions and allows access to protected resources at unauthorized times.

In Keycloak with Fine-Grained Admin Permissions V2 enabled, a sub-administrator with user creation permissions can add new users to any group, even those they are not authorized to manage.

A flaw in the full-scope-disabled client-policy executor in keycloak-services causes it to only validate the fullScopeAllowed field when explicitly provided. Omitting this field allows a delegated user to bypass the policy and create a client with full scope access, obtaining tokens with unauthorized role mappings.

In the TokenManager component of Keycloak, an administrator attempting to revoke tokens for a specific application using a "not-before" policy may have the revocation silently ignored if the realm already has an older, non-zero revocation policy. This can allow previously issued tokens to remain valid for session refresh and data access.

In the SAML protocol implementation of Keycloak, when a client is configured with a wildcard redirect URL, an attacker can craft a request with malicious parameters. After user authentication, Keycloak appends its legitimate response to the attacker's parameters, potentially causing the service provider to process the attacker's data instead of real login information, leading to user login to the wrong account.

In Keycloak, the token exchange feature does not enforce organization (tenant) restrictions when logging in via Microsoft. An attacker with a valid Microsoft token from a different organization can gain access to the Keycloak realm, potentially accessing sensitive data or performing unauthorized actions.

In Keycloak, the token exchange feature does not enforce Google Workspace domain restrictions when logging in via Google. An attacker with a valid Google account from a different domain can bypass security checks and gain access to the Keycloak realm.

In the secure-client-uris component of Keycloak, URL validation only checks the start of the address rather than properly verifying the host. An attacker can bypass security restrictions requiring encrypted connections for redirect URIs by using a specially crafted domain name, potentially allowing interception of authentication codes over unencrypted connections.

In the keycloak-services component of Keycloak, the security check preventing HTTP parameter pollution only inspects the query portion of a redirect URL, ignoring the fragment. When a client is configured with a wildcard redirect URI, an attacker can inject duplicate security parameters into the login response. If the client application is not configured correctly, it might trust the attacker's injected data instead of real security information from Keycloak, leading to session fixation or account confusion.

In the OIDC token introspection endpoint of keycloak-services, a confidential client configured to receive signed JWT responses may receive the full set of token claims in a signed JWT field even if the token was issued for a different audience. This allows an unauthorized client to bypass audience-based restrictions and access sensitive information.

In Keycloak's keycloak-services component, a realm administrator can use a wildcard domain (e.g., *.example.com) to restrict client registration. Due to improper validation, the system accepts any hostname ending with the domain suffix, even if not a legitimate subdomain. An attacker controlling reverse DNS can bypass these restrictions and potentially make unauthorized client modifications.

In Keycloak, the group policy evaluation logic uses a simple text-based prefix check to verify group membership instead of exact matching. A user belonging to a group with a similar starting name can bypass security checks and gain unauthorized access to administrative functions or protected resources.

In the RoleContainerResource component of Keycloak, name-based admin REST API endpoints do not properly enforce authorization checks when managing composite roles. A delegated administrator with manage-realm permissions can remove essential child roles from built-in admin roles, potentially disrupting administrative functions within a realm.

A flaw was found in the client policy enforcement mechanism of Keycloak. The issue occurs when the system checks group membership by name instead of a unique identifier. An attacker with client management privileges could bypass security policies by joining a group with a matching name in a different part of the group hierarchy, potentially allowing them to register or update clients without following required security hardening profiles.

Keycloak provides a way to manage identity providers and organizations through its administrative API. A flaw was discovered where an administrator with permission to manage identity providers could link a new provider to an organization without having the required permissions to manage that organization. This could allow an unauthorized administrator to influence how users log into specific organizations.

In the keycloak-services library, the core component of the Keycloak identity and access management solution, the role-users endpoint fails to check if an administrator has permission to view individual users when listing role members. A restricted administrator can see private information, such as names and email addresses, of users they should not be able to access.

In the Keycloak Admin REST API, used to manage security realms and clients, when processing requests for rotated client secrets stored in a secure vault, a delegated administrator with view-only permissions can retrieve the actual resolved secret instead of the vault placeholder. This occurs due to improper boundary enforcement, leading to exposure of sensitive credentials.

A flaw in Keycloak's default-groups REST endpoint and realm representation allows a delegated administrator with realm-viewing permissions to see names and identifiers of hidden default groups, even without specific permissions to view those groups.

A missing authorization check in Keycloak's admin REST API allows a delegated administrator to remove privileged child roles from composite roles without proper permissions. This can result in loss of access for other users and administrators.

A flaw was found in the keycloak-services component, the core engine of Red Hat Build of Keycloak, where sensitive configuration values such as reCAPTCHA secret keys are not masked when requested by administrators with view-only permissions. This can lead to the exposure of third-party service credentials to unauthorized personnel or through administrative logs.

In Keycloak, an incomplete fix for CVE-2026-9798 was found. Brute-force protection was added to the CIBA initiation handler but omitted from the token redemption handler. This allows an attacker with valid client credentials to obtain access and refresh tokens for a locked user account if the authentication request was started before the lockout and approved by the user.

A flaw in Keycloak's Client Policies mechanism allows bypassing the requirement for signed JWT assertions. An attacker with valid client credentials can provide a fake, unsigned assertion header, tricking the system into thinking policy requirements are met.

In the keycloak-services component of Red Hat Build of Keycloak, OAuth 2.0 authorization codes are not properly bound to the client that originally requested them. An attacker who intercepts a code can modify it and redeem it with their own client, obtaining access tokens for the victim's identity.

A flaw in the organization management component of Keycloak allows a delegated administrator with permission to manage organizations to create an invitation for a non-existent email address and retrieve the secret registration link via the API. Using this link, the administrator can create new user accounts and add them to the organization without the required user management permissions or access to the invited email account. This allows bypassing security boundaries and adding unauthorized members.

A flaw in the Keycloak keycloak-services component, which handles identity provider management, allows a delegated administrator to update an OIDC identity provider using a masked client secret sentinel value. Due to improper validation, Keycloak reuses the existing real secret even if security-sensitive fields like the token URL have been changed, enabling an attacker to redirect and capture the secret.

A flaw was found in Keycloak's group search functionality in the administrative API. When Fine-Grained Admin Permissions (FGAP) v2 is enabled, a delegated administrator can bypass access restrictions to view parent groups they are not authorized to see. Searching for a child group incorrectly returns full details of the parent group, disclosing sensitive group attributes and configuration.

A flaw in Keycloak's JWT authorization grant preview feature fails to validate disabled user accounts during JWT processing, allowing an attacker to obtain a token for a disabled user.

A flaw in the org.keycloak.broker.oidc package causes incorrect synchronization of the email_verified claim. When an OIDC identity provider has trustEmail=true and the userinfo endpoint is enabled, Keycloak retrieves the email from userinfo but the email_verified status only from the id_token. Lack of validation allows applying email_verified=true to a different email address from userinfo.

A flaw in Keycloak's Fine-Grained Admin Permissions (FGAP) v2 implementation allows a delegated administrator to view details of child groups they are not authorized to access. The system fails to properly filter child groups based on the caller's permissions when requested through a parent group.

A flaw was found in the ClientResource component of Keycloak's admin services when Fine-Grained Admin Permissions (FGAP) v2 is enabled. This allows a delegated administrator to attach or remove hidden client scopes they are not authorized to manage.

A vulnerability in Keycloak's administrative interface allows restricted administrators to view information about groups they should not have access to. When Fine-Grained Admin Permissions (FGAP v2) are enabled, an administrator who can see a specific role can also see all groups assigned to that role, without proper permission checks. This can expose hidden groups and their details, such as internal names and custom settings, potentially containing sensitive deployment information.

A flaw was found in Keycloak where a user with `manage-clients` permission can inject a hardcoded role mapper into any client. This bypasses scope restrictions and adds the `realm-admin` role to tokens, leading to privilege escalation and full administrative access to the realm.

A vulnerability in Keycloak's Admin UI allows administrators with limited permissions to bypass security restrictions. When Fine-Grained Admin Permissions (FGAPv2) are enabled, an admin who can only search for users can use the 'brute-force-user' endpoint to access full user profiles, including sensitive information and security metadata. The issue is due to missing permission checks for the 'view' right on this specific search path.

A flaw in the Identity Provider (IdP) mapper component of Keycloak allows an administrator with limited permissions to assign high-level administrative roles (e.g., realm-admin) to themselves or others by creating a 'Hardcoded Role' mapper. This bypasses security checks and grants full control over the entire realm.

A flaw was found in Keycloak where JWT algorithm confusion in the JWT Authorization Grant flow allows an attacker with valid client credentials to bypass signature verification by forging an assertion.