Executive brief
Keycloak is an open-source identity and access management platform that secures authentication and authorization for applications. A flaw in its Admin REST API allows a limited-privilege administrator to read or modify sensitive client configurations in the master realm by exploiting a missing security check. An attacker could steal client credentials or redirect administrative logins to malicious sites.
Technical details
The Admin REST API uses a per-request in-memory cache to resolve clients by UUID but fails to verify that the client belongs to the realm in the request path, allowing cross-realm access. This missing authorization check (CWE-862) requires an attacker to have admin role creation privileges and knowledge of specific client UUIDs in the master realm. Exploitation results in confidentiality loss (credential exposure) and integrity compromise (client configuration modification).
Affected products
- Red Hat Keycloak
Timeline
- 2026-09-21: disclosed