Keycloak vulnerabilities

A flaw in Keycloak Policy Enforcer allows any authenticated user to bypass all authorization policies, including role, scope, and UMA permission checks. By including the configured access-denied page path in a request URL (as a path segment or query parameter), an attacker can gain unauthorized access to protected resources.

A flaw was found in the Keycloak authorization component. An authenticated user with a UMA permission ticket for one resource can bypass per-resource access control for all resources of the same type on the resource server by using a specific permission request prefix. This vulnerability requires PERMISSIVE policy enforcement mode and ownerManagedAccess enabled for typed resources without explicit policies.

A flaw in Keycloak's client registration service allows a remote attacker with a previously issued Registration Access Token (RAT) to re-enable a client disabled by an administrator. The attacker can reset the client secret and potentially regain privileged API access.

A missing authorization check in the Keycloak GroupResource.addChild() endpoint in the Admin REST API allows an authenticated user with limited admin privileges to reparent any existing group. With FGAPv2 enabled, an attacker can move a privileged group under their managed group.

A flaw in Keycloak allows a remote attacker with administrative privileges (having `manage-client` permission or access to client registration endpoints) to bypass client URI validation. The attacker can register a malicious client with a crafted redirect URI using case-insensitive `javascript:` or `data:` schemes, leading to a Cross-Site Scripting (XSS) vulnerability.

A flaw was found in Keycloak where a realm administrator with the 'manage-realm' role can submit an arbitrary filesystem path as a keystore parameter when creating a key provider component. This allows probing of arbitrary filesystem paths to determine which files exist and are readable by the Keycloak process.

The reported vulnerability was rejected because the described behavior does not constitute a privilege escalation. The attacker must already possess the manage-realm administrative role within the realm-management client, which is by design equivalent to realm-admin. Importing users with realm-admin role mappings via POST /admin/realms/{realm}/partialImport does not grant any additional privileges.

In org.keycloak.services, an administrator with delegated access to read group memberships and users can bypass user profile permissions by accessing the group members endpoint, allowing them to view user attributes that are explicitly denied.

A flaw was found in Keycloak where, with revokeRefreshToken=true enabled and persistent session storage in use, a server restart can reset internal timing mechanisms, allowing a remote attacker who has captured a user's refresh token to replay it even after revocation.

A flaw was found in Keycloak where a remote attacker with high privileges (e.g., a realm administrator configuring a malicious LDAP server or an attacker compromising an upstream LDAP server) can trigger an OutOfMemoryError by sending a malformed LDAP password policy response during a password authentication request. This causes the Keycloak JVM to terminate, leading to a denial of service (DoS) for all realms on the affected node.

A flaw was found in Keycloak's Fine-Grained Admin Permissions (FGAPv2) feature. An administrator with limited client management permissions can assign any realm role, including highly privileged ones, to a client's scope mapping. This bypasses security controls and injects the role into a user's authentication token.

A flaw was found in Keycloak where an authenticated user with existing organization membership can disclose organization metadata in OIDC tokens or via the account API, even after the administrator has disabled the Organizations feature, potentially leading to incorrect authorization decisions by resource servers.

In Keycloak, the cross-session verification proof is keyed only by (localUserId, idpAlias) and is not bound to the upstream identity. A second upstream account on the same IdP can consume it and get linked to the victim's local account.

A session fixation vulnerability was found in Keycloak's login-actions endpoints. An unauthenticated attacker can pre-create an authentication session and trick a victim into clicking a malicious link, allowing the attacker to hijack the required-action form without the victim's credentials. Successful exploitation could lead to complete account takeover, including highly privileged administrative accounts.

A flaw was found in Keycloak's URL validation logic during redirect operations. By crafting a malicious request, an attacker could bypass validation to redirect users to unauthorized URLs, potentially leading to the exposure of sensitive information within the domain or facilitating further attacks. This vulnerability specifically affects Keycloak clients configured with a wildcard (*) in the "Valid Redirect URIs" field and requires user interaction to be successfully exploited.

A flaw was found in Keycloak where a remote, unauthenticated attacker can send a specially crafted XML input to the SAML endpoint, causing high CPU usage and worker thread starvation, leading to a Denial of Service (DoS) and server unavailability.

In Keycloak, when both realm-level and client-level `notBefore` revocation policies are configured, the OIDC Introspection feature fails to honor the realm-level policy, leaving tokens that should be revoked active.

An authenticated user can bypass configured WebAuthn policies during credential registration by manipulating client-side JavaScript. The server fails to validate that the new credential's parameters match the realm's WebAuthn policies.

A flaw in Keycloak allows an authenticated user with the uma_protection role to bypass User-Managed Access (UMA) policy validation. The attacker can include resource identifiers owned by other users in a policy creation request, even if the URL path specifies an attacker-owned resource. This leads to unauthorized access to sensitive information or unauthorized actions.

A flaw in Keycloak allows an unauthenticated attacker to cause a Denial of Service (DoS) by sending a crafted POST request with an excessively long scope parameter to the OIDC token endpoint, leading to high resource consumption and prolonged processing.

A flaw in Keycloak's SingleUseObjectProvider, a global key-value store, lacks proper type and namespace isolation, allowing an unauthenticated attacker to forge authorization codes.

A flaw was found in Keycloak allowing an attacker controlling another path on the same web server to bypass the allowed path in redirect URIs using a wildcard. A successful attack may lead to theft of an access token and information disclosure.

A flaw was found in Keycloak. An authenticated attacker can perform Server-Side Request Forgery (SSRF) by manipulating the `client_session_host` parameter during refresh token requests. This occurs when a Keycloak client is configured to use the `backchannel.logout.url` with the `application.session.host` placeholder.

A flaw was identified in Keycloak, an identity and access management solution, where it improperly follows HTTP redirects when processing certain client configuration requests. This behavior allows an attacker to trick the server into making unintended requests to internal or restricted resources.

A flaw was found in Keycloak where a remote attacker can bypass security controls by sending a valid SAML response from an external Identity Provider (IdP) to the Keycloak SAML endpoint for IdP-initiated broker logins. This allows the attacker to complete broker logins even when the SAML Identity Provider is disabled, leading to unauthorized authentication.

A flaw in Keycloak's SAML broker endpoint fails to properly validate encrypted assertions when the overall SAML response is unsigned. An attacker with a valid signed assertion can inject an encrypted assertion for an arbitrary principal.

A flaw was found in Keycloak. An authorization bypass vulnerability in the Keycloak Admin API allows any authenticated user, even those without administrative privileges, to enumerate the organization memberships of other users. This information disclosure occurs if the attacker knows the victim's unique identifier (UUID) and the Organizations feature is enabled.

A flaw was identified in the Account REST API of Keycloak that allows a user authenticated at a lower security level to perform sensitive actions intended only for higher-assurance sessions. Specifically, an attacker who has already obtained a victim’s password can delete the victim’s registered MFA/OTP credential without first proving possession of that factor. The attacker can then register their own MFA device, effectively taking full control of the account. This weakness undermines the intended protection provided by multi-factor authentication.

A flaw was found in the org.keycloak.broker.saml component. When a disabled SAML client is configured as an IdP-initiated broker landing target, it can still complete the login process and establish an SSO session. This allows a remote attacker to gain unauthorized access to other enabled clients without re-authentication, bypassing security restrictions.

A vulnerability in Keycloak allows authentication through a disabled Identity Provider (IdP) by reusing a previously generated login request. An attacker knowing the IdP alias can bypass the administrative restriction and gain access.

A flaw was found in Keycloak's WebAuthn registration component. This vulnerability allows an attacker to bypass the configured attestation policy and register untrusted or forged authenticators via submission of an attestation object with fmt: "none", even when the realm is configured to require direct attestation. This can lead to weakened authentication integrity and unauthorized authenticator registration.

A flaw in Keycloak allows an attacker to modify the organization ID and target email in a valid invitation JWT token. Lack of cryptographic signature verification enables self-registration into an unauthorized organization.

A flaw was found in Keycloak in the jwt-authorization-grant flow where the server fails to verify if an Identity Provider (IdP) is enabled before issuing tokens. The issuer lookup mechanism retrieves the IdP configuration but does not filter for isEnabled=false. An entity possessing the signing key of a disabled IdP can still generate valid JWT assertions that Keycloak accepts, resulting in valid access tokens.

This CVE number has been rejected. After further review by the Keycloak project and Red Hat, the reported SSRF via client registration/backchannel notification URIs was determined not to constitute a security vulnerability. The reported behavior is expected administrator-controlled functionality, and Keycloak provides documented mitigations through Client Policies.

A flaw was found in Keycloak. This improper input validation vulnerability occurs because Keycloak accepts RFC-compliant matrix parameters in URL path segments, while common reverse proxy configurations may ignore or mishandle them. A remote attacker can craft requests to mask path segments, potentially bypassing proxy-level path filtering. This could expose administrative or sensitive endpoints that operators believe are not externally reachable.

A flaw was found in Keycloak. The Keycloak guides recommend not to expose the /admin path to the outside when using a proxy. The issue occurs at least via ha-proxy, as it can be tricked into using relative/non-normalized paths to access the /admin application path relative to /realms, which is expected to be exposed.

A flaw was found in Keycloak that allows an authenticated attacker to merge their account with an existing victim's account during identity provider login. The attacker can change their email address to that of the victim, triggering a verification email to the victim.

A vulnerability was found in Keycloak where the environment option `KC_CACHE_EMBEDDED_MTLS_ENABLED` does not work and the JGroups replication configuration is always used in plain text, which can allow an attacker with access to adjacent networks related to JGroups to read sensitive information.

A vulnerability was found in Keycloak Server, making it vulnerable to denial of service due to improper handling of proxy headers. When configured to accept incoming proxy headers, it may accept non-IP values without validation, leading to costly DNS resolution operations that can tie up IO threads and cause DoS. The attacker must have access to a Keycloak instance configured to accept proxy headers, especially when reverse proxies do not overwrite incoming headers.

A vulnerability in Keycloak allows a user with high privileges to read sensitive information from a Vault file outside the expected context. The attacker must have prior high access to the Keycloak server, for example, to configure an LDAP provider and set up a Vault file read, which only reveals whether the file exists.

A flaw in Keycloak causes sensitive runtime values, such as passwords, to be captured during the build process and embedded as default values in bytecode, leading to unintended information disclosure. This affects direct environment variables in Keycloak 26 and indirect usage in earlier versions.

A vulnerability in the Keycloak-services package. If untrusted data is passed to the SearchQueryUtils method, it could lead to a denial of service (DoS) scenario by exhausting system resources due to a Regex complexity.

A misconfiguration flaw was found in Keycloak. This issue can allow an attacker to redirect users to an arbitrary URL if a 'Valid Redirect URI' is set to http://localhost or http://127.0.0.1, enabling sensitive information such as authorization codes to be exposed to the attacker, potentially leading to session hijacking.

A flaw in SAML client registration in Keycloak allows an administrator to register malicious JavaScript URIs as Assertion Consumer Service POST Binding URLs (ACS), posing a Cross-Site Scripting (XSS) risk. This may allow a malicious admin in one realm or a client with registration access to target users in different realms or applications, executing arbitrary JavaScript in their contexts upon form submission.

A log injection flaw was found in Keycloak. A text string may be injected through the authentication form when using the WebAuthn authentication mode. This issue may have a minor impact to the logs integrity.

A flaw in Keycloak where it does not properly validate URLs included in a redirect. An attacker could construct a malicious request to bypass validation and access other URLs and sensitive information within the domain or conduct further attacks. This affects any client that utilizes a wildcard in the Valid Redirect URIs field and requires user interaction within the malicious URL.