Executive brief
Keycloak is an open-source identity and access management solution used to secure applications and manage user identities. A security flaw in its identity provider component allows a restricted administrator to bypass safety checks and grant themselves full administrative control over the entire system. This could lead to a complete takeover of the security realm, allowing the attacker to access or modify all user data and system configurations.
Technical details
An improper authorization flaw exists in the Identity Provider (IdP) mapper component (org.keycloak.broker) of Keycloak. The endpoint fails to enforce the 'requireMapRole' authorization check, which is intended to prevent administrators from assigning roles they do not themselves possess. An attacker with 'manage-identity-providers' permissions can exploit this by creating a 'Hardcoded Role' mapper for a malicious OIDC or SAML provider that targets high-privilege roles like 'realm-admin'. Upon authenticating through the controlled IdP, the high-level role is injected into the user's session, resulting in full privilege escalation.
Affected products
- Red Hat Keycloak
- Red Hat Red Hat Build of Keycloak
Timeline
- 2026-06-16: other: Reported to Red Hat Bugzilla
- 2026-06-30: disclosed: CVE published