Executive brief
Keycloak is an open-source identity and access management solution used to secure modern applications and services. A vulnerability allows a user who already has permission to manage clients to grant themselves full administrative control over the entire security realm. This could lead to an attacker gaining complete access to user data, security configurations, and the ability to modify authentication policies across the organization.
Technical details
A flaw in Keycloak's role mapping logic allows a highly privileged user with the `manage-clients` permission to escalate their privileges to `realm-admin`. By injecting an `oidc-hardcoded-role-mapper` into a client configuration and setting it to the `realm-management.realm-admin` role, the attacker can bypass existing scope restrictions (such as `fullScopeAllowed: false`). When authenticating through the modified client, the generated token includes the injected administrative role, granting the attacker full access to the realm's administrative APIs. This is classified as Incorrect Privilege Assignment (CWE-266).
Affected products
- Keycloak Keycloak
- Red Hat Red Hat Build of Keycloak
Timeline
- 2026-03-23: other: Bug reported in Red Hat Bugzilla
- 2026-06-30: disclosed: CVE published to NVD