Executive brief
A security policy enforcement bug in Red Hat's Keycloak identity management service allows delegated administrators to bypass access controls during client registration. By omitting a required policy field in API requests, attackers can create clients with unrestricted scope access, enabling them to issue authentication tokens with privileges far beyond what they should have. This could allow unauthorized access to internal APIs and services within an organization.
Technical details
The vulnerability is an authorization bypass in the full-scope-disabled client-policy executor within keycloak-services. The root cause is incomplete validation logic: the executor only checks the fullScopeAllowed field when explicitly present in a request, allowing an attacker to omit the field entirely to bypass the policy. The attack requires authentication as a delegated user with client management privileges. An attacker can create a client with full scope access and obtain tokens with unauthorized role mappings, potentially gaining access to protected resources. Patches are expected from Red Hat; administrators should watch for security advisories and apply updates promptly.
Affected products
- Red Hat Keycloak <UNKNOWN>
Timeline
- 2026-08-02: disclosed