Executive brief
Keycloak is an open-source authentication and authorization platform used to manage user login and access control. A security flaw allows realm administrators' clients with management permissions to bypass enforced security policies by creating a public client and then converting it to a confidential client with weaker authentication requirements, resulting in non-compliant security configurations persisting in the system.
Technical details
The vulnerability is a policy enforcement bypass in the keycloak-services component affecting client policy evaluation during client state updates. An attacker with client management permissions can circumvent realm administrator-configured client policies by exploiting improper validation during the transition from public to confidential client mode. The attack requires authenticated access (client management role) and proceeds by creating a public client and then updating it to confidential status with relaxed authentication settings. This allows persistence of clients that violate the realm's intended security hardening policies. A fix is expected to improve state validation during client updates.
Affected products
- Keycloak Keycloak
Timeline
- 2026-08-02: disclosed