Keycloak vulnerabilities

A flaw in the keycloak-services component of Keycloak causes improper evaluation of client state during an update operation. An attacker with client management permissions can bypass security policies by first creating a public client and then updating it to a confidential client with weaker authentication.

A flaw in Keycloak's authorization services allows a user to include a fake time value in an authorization request, overriding the actual server time. This bypasses time-based restrictions and allows access to protected resources at unauthorized times.

In Keycloak with Fine-Grained Admin Permissions V2 enabled, a sub-administrator with user creation permissions can add new users to any group, even those they are not authorized to manage.

A flaw in the full-scope-disabled client-policy executor in keycloak-services causes it to only validate the fullScopeAllowed field when explicitly provided. Omitting this field allows a delegated user to bypass the policy and create a client with full scope access, obtaining tokens with unauthorized role mappings.

In the TokenManager component of Keycloak, an administrator attempting to revoke tokens for a specific application using a "not-before" policy may have the revocation silently ignored if the realm already has an older, non-zero revocation policy. This can allow previously issued tokens to remain valid for session refresh and data access.

In the SAML protocol implementation of Keycloak, when a client is configured with a wildcard redirect URL, an attacker can craft a request with malicious parameters. After user authentication, Keycloak appends its legitimate response to the attacker's parameters, potentially causing the service provider to process the attacker's data instead of real login information, leading to user login to the wrong account.

In Keycloak, the token exchange feature does not enforce organization (tenant) restrictions when logging in via Microsoft. An attacker with a valid Microsoft token from a different organization can gain access to the Keycloak realm, potentially accessing sensitive data or performing unauthorized actions.

In Keycloak, the token exchange feature does not enforce Google Workspace domain restrictions when logging in via Google. An attacker with a valid Google account from a different domain can bypass security checks and gain access to the Keycloak realm.

In the secure-client-uris component of Keycloak, URL validation only checks the start of the address rather than properly verifying the host. An attacker can bypass security restrictions requiring encrypted connections for redirect URIs by using a specially crafted domain name, potentially allowing interception of authentication codes over unencrypted connections.

In the keycloak-services component of Keycloak, the security check preventing HTTP parameter pollution only inspects the query portion of a redirect URL, ignoring the fragment. When a client is configured with a wildcard redirect URI, an attacker can inject duplicate security parameters into the login response. If the client application is not configured correctly, it might trust the attacker's injected data instead of real security information from Keycloak, leading to session fixation or account confusion.

In the OIDC token introspection endpoint of keycloak-services, a confidential client configured to receive signed JWT responses may receive the full set of token claims in a signed JWT field even if the token was issued for a different audience. This allows an unauthorized client to bypass audience-based restrictions and access sensitive information.

In Keycloak's keycloak-services component, a realm administrator can use a wildcard domain (e.g., *.example.com) to restrict client registration. Due to improper validation, the system accepts any hostname ending with the domain suffix, even if not a legitimate subdomain. An attacker controlling reverse DNS can bypass these restrictions and potentially make unauthorized client modifications.

In Keycloak, the group policy evaluation logic uses a simple text-based prefix check to verify group membership instead of exact matching. A user belonging to a group with a similar starting name can bypass security checks and gain unauthorized access to administrative functions or protected resources.

In the RoleContainerResource component of Keycloak, name-based admin REST API endpoints do not properly enforce authorization checks when managing composite roles. A delegated administrator with manage-realm permissions can remove essential child roles from built-in admin roles, potentially disrupting administrative functions within a realm.

A flaw was found in the client policy enforcement mechanism of Keycloak. The issue occurs when the system checks group membership by name instead of a unique identifier. An attacker with client management privileges could bypass security policies by joining a group with a matching name in a different part of the group hierarchy, potentially allowing them to register or update clients without following required security hardening profiles.

Keycloak provides a way to manage identity providers and organizations through its administrative API. A flaw was discovered where an administrator with permission to manage identity providers could link a new provider to an organization without having the required permissions to manage that organization. This could allow an unauthorized administrator to influence how users log into specific organizations.

In the keycloak-services library, the core component of the Keycloak identity and access management solution, the role-users endpoint fails to check if an administrator has permission to view individual users when listing role members. A restricted administrator can see private information, such as names and email addresses, of users they should not be able to access.

In the Keycloak Admin REST API, used to manage security realms and clients, when processing requests for rotated client secrets stored in a secure vault, a delegated administrator with view-only permissions can retrieve the actual resolved secret instead of the vault placeholder. This occurs due to improper boundary enforcement, leading to exposure of sensitive credentials.

A flaw in Keycloak's default-groups REST endpoint and realm representation allows a delegated administrator with realm-viewing permissions to see names and identifiers of hidden default groups, even without specific permissions to view those groups.

A missing authorization check in Keycloak's admin REST API allows a delegated administrator to remove privileged child roles from composite roles without proper permissions. This can result in loss of access for other users and administrators.

A flaw was found in the keycloak-services component, the core engine of Red Hat Build of Keycloak, where sensitive configuration values such as reCAPTCHA secret keys are not masked when requested by administrators with view-only permissions. This can lead to the exposure of third-party service credentials to unauthorized personnel or through administrative logs.

In Keycloak, an incomplete fix for CVE-2026-9798 was found. Brute-force protection was added to the CIBA initiation handler but omitted from the token redemption handler. This allows an attacker with valid client credentials to obtain access and refresh tokens for a locked user account if the authentication request was started before the lockout and approved by the user.

A flaw in Keycloak's Client Policies mechanism allows bypassing the requirement for signed JWT assertions. An attacker with valid client credentials can provide a fake, unsigned assertion header, tricking the system into thinking policy requirements are met.

In the keycloak-services component of Red Hat Build of Keycloak, OAuth 2.0 authorization codes are not properly bound to the client that originally requested them. An attacker who intercepts a code can modify it and redeem it with their own client, obtaining access tokens for the victim's identity.

A flaw in the organization management component of Keycloak allows a delegated administrator with permission to manage organizations to create an invitation for a non-existent email address and retrieve the secret registration link via the API. Using this link, the administrator can create new user accounts and add them to the organization without the required user management permissions or access to the invited email account. This allows bypassing security boundaries and adding unauthorized members.

A flaw in the Keycloak keycloak-services component, which handles identity provider management, allows a delegated administrator to update an OIDC identity provider using a masked client secret sentinel value. Due to improper validation, Keycloak reuses the existing real secret even if security-sensitive fields like the token URL have been changed, enabling an attacker to redirect and capture the secret.

A flaw was found in Keycloak's group search functionality in the administrative API. When Fine-Grained Admin Permissions (FGAP) v2 is enabled, a delegated administrator can bypass access restrictions to view parent groups they are not authorized to see. Searching for a child group incorrectly returns full details of the parent group, disclosing sensitive group attributes and configuration.

A flaw in Keycloak's JWT authorization grant preview feature fails to validate disabled user accounts during JWT processing, allowing an attacker to obtain a token for a disabled user.

A flaw in the org.keycloak.broker.oidc package causes incorrect synchronization of the email_verified claim. When an OIDC identity provider has trustEmail=true and the userinfo endpoint is enabled, Keycloak retrieves the email from userinfo but the email_verified status only from the id_token. Lack of validation allows applying email_verified=true to a different email address from userinfo.

A flaw in Keycloak's Fine-Grained Admin Permissions (FGAP) v2 implementation allows a delegated administrator to view details of child groups they are not authorized to access. The system fails to properly filter child groups based on the caller's permissions when requested through a parent group.

A flaw was found in the ClientResource component of Keycloak's admin services when Fine-Grained Admin Permissions (FGAP) v2 is enabled. This allows a delegated administrator to attach or remove hidden client scopes they are not authorized to manage.

A vulnerability in Keycloak's administrative interface allows restricted administrators to view information about groups they should not have access to. When Fine-Grained Admin Permissions (FGAP v2) are enabled, an administrator who can see a specific role can also see all groups assigned to that role, without proper permission checks. This can expose hidden groups and their details, such as internal names and custom settings, potentially containing sensitive deployment information.

A flaw was found in Keycloak where a user with `manage-clients` permission can inject a hardcoded role mapper into any client. This bypasses scope restrictions and adds the `realm-admin` role to tokens, leading to privilege escalation and full administrative access to the realm.

A vulnerability in Keycloak's Admin UI allows administrators with limited permissions to bypass security restrictions. When Fine-Grained Admin Permissions (FGAPv2) are enabled, an admin who can only search for users can use the 'brute-force-user' endpoint to access full user profiles, including sensitive information and security metadata. The issue is due to missing permission checks for the 'view' right on this specific search path.

A flaw in the Identity Provider (IdP) mapper component of Keycloak allows an administrator with limited permissions to assign high-level administrative roles (e.g., realm-admin) to themselves or others by creating a 'Hardcoded Role' mapper. This bypasses security checks and grants full control over the entire realm.

A flaw was found in Keycloak where JWT algorithm confusion in the JWT Authorization Grant flow allows an attacker with valid client credentials to bypass signature verification by forging an assertion.

A flaw in Keycloak Policy Enforcer allows any authenticated user to bypass all authorization policies, including role, scope, and UMA permission checks. By including the configured access-denied page path in a request URL (as a path segment or query parameter), an attacker can gain unauthorized access to protected resources.

A flaw was found in the Keycloak authorization component. An authenticated user with a UMA permission ticket for one resource can bypass per-resource access control for all resources of the same type on the resource server by using a specific permission request prefix. This vulnerability requires PERMISSIVE policy enforcement mode and ownerManagedAccess enabled for typed resources without explicit policies.

A flaw in Keycloak's client registration service allows a remote attacker with a previously issued Registration Access Token (RAT) to re-enable a client disabled by an administrator. The attacker can reset the client secret and potentially regain privileged API access.

A missing authorization check in the Keycloak GroupResource.addChild() endpoint in the Admin REST API allows an authenticated user with limited admin privileges to reparent any existing group. With FGAPv2 enabled, an attacker can move a privileged group under their managed group.

A flaw in Keycloak allows a remote attacker with administrative privileges (having `manage-client` permission or access to client registration endpoints) to bypass client URI validation. The attacker can register a malicious client with a crafted redirect URI using case-insensitive `javascript:` or `data:` schemes, leading to a Cross-Site Scripting (XSS) vulnerability.

A flaw was found in Keycloak where a realm administrator with the 'manage-realm' role can submit an arbitrary filesystem path as a keystore parameter when creating a key provider component. This allows probing of arbitrary filesystem paths to determine which files exist and are readable by the Keycloak process.

The reported vulnerability was rejected because the described behavior does not constitute a privilege escalation. The attacker must already possess the manage-realm administrative role within the realm-management client, which is by design equivalent to realm-admin. Importing users with realm-admin role mappings via POST /admin/realms/{realm}/partialImport does not grant any additional privileges.

In org.keycloak.services, an administrator with delegated access to read group memberships and users can bypass user profile permissions by accessing the group members endpoint, allowing them to view user attributes that are explicitly denied.

A flaw was found in Keycloak where, with revokeRefreshToken=true enabled and persistent session storage in use, a server restart can reset internal timing mechanisms, allowing a remote attacker who has captured a user's refresh token to replay it even after revocation.

A flaw was found in Keycloak where a remote attacker with high privileges (e.g., a realm administrator configuring a malicious LDAP server or an attacker compromising an upstream LDAP server) can trigger an OutOfMemoryError by sending a malformed LDAP password policy response during a password authentication request. This causes the Keycloak JVM to terminate, leading to a denial of service (DoS) for all realms on the affected node.

A flaw was found in Keycloak's Fine-Grained Admin Permissions (FGAPv2) feature. An administrator with limited client management permissions can assign any realm role, including highly privileged ones, to a client's scope mapping. This bypasses security controls and injects the role into a user's authentication token.

A flaw was found in Keycloak where an authenticated user with existing organization membership can disclose organization metadata in OIDC tokens or via the account API, even after the administrator has disabled the Organizations feature, potentially leading to incorrect authorization decisions by resource servers.

In Keycloak, the cross-session verification proof is keyed only by (localUserId, idpAlias) and is not bound to the upstream identity. A second upstream account on the same IdP can consume it and get linked to the victim's local account.

A session fixation vulnerability was found in Keycloak's login-actions endpoints. An unauthenticated attacker can pre-create an authentication session and trick a victim into clicking a malicious link, allowing the attacker to hijack the required-action form without the victim's credentials. Successful exploitation could lead to complete account takeover, including highly privileged administrative accounts.