Executive brief
Keycloak is an open-source identity and access management solution used to secure modern applications and services. A security flaw in its administrative component allows delegated administrators to bypass restrictions and attach unauthorized 'client scopes' to the applications they manage. This could allow an attacker to inject unauthorized permissions or data into security tokens, potentially tricking other business applications into granting higher levels of access than intended.
Technical details
A write-path authorization bypass exists in the ClientResource.addDefaultClientScope() and related endpoints in Keycloak when adminPermissionsEnabled is set to true (FGAP v2). The vulnerability is caused by insufficient permission validation; the system verifies the caller has 'manage' permissions on the target client but fails to verify if they have permissions to view or map the specific client scope being attached. An attacker with a delegated admin role (Clients:view and Clients:manage) can exploit this by discovering the UUID of a restricted client scope and linking it to their managed client. This allows the injection of unauthorized claims into end-user access tokens, which may lead to authorization bypasses in downstream applications relying on those tokens.
Affected products
- Red Hat Build of Keycloak FGAP v2 enabled
Timeline
- 2026-07-03: disclosed
- 2026-07-03: advisory