Executive brief
Keycloak is an open-source identity and access management system that organizations use to control who can access their applications and data. A flaw in its administration API allows a delegated administrator with limited permissions to secretly add themselves to a high-privilege group, gaining complete control over the entire authentication system and all protected applications. An attacker must already have some administrative access to exploit this vulnerability.
Technical details
The Admin REST API fails to validate whether a target group grants administrative privileges before allowing group membership changes, enabling privilege escalation from a delegated administrator to realm-admin. The vulnerability affects group-membership endpoints and requires the attacker to already possess delegated administrative privileges (CWE-862: Missing Authorization). No mitigation is currently available, though this requires a specific pre-existing configuration where administrative roles are mapped to groups.
Affected products
- Keycloak Project Keycloak
Timeline
- 2026-09-19: disclosed