Keycloak vulnerabilities

A flaw in the Micrometer user-event metrics listener of Keycloak occurs when the listener is configured to include the idp tag. An unauthenticated attacker can send requests to the identity broker login endpoint using arbitrary provider aliases, causing the system to create an unlimited number of metric time series, leading to excessive memory consumption and degraded performance of the server and monitoring tools.

A flaw was found in the first-broker-login flow of the keycloak-services component. It allows an attacker to register a matching username on an external identity provider, causing a collision in Keycloak and locking out the legitimate user.

Keycloak is an open-source identity and access management solution. A vulnerability was discovered where a user with the impersonation role can impersonate a realm administrator, gaining full administrative control over the realm, including the ability to manage users, clients, and roles.

A flaw was found in the theme localization endpoints of the keycloak-services component, which is the core service responsible for authentication flows and theme management in Keycloak. The issue occurs because the system accepts arbitrary locale tags from unauthenticated requests and stores them in a permanent in-memory cache without limits. An attacker can exploit this by sending a large number of unique locale tags, eventually causing the server to run out of memory and crash.

A flaw was found in the SAML Redirect Binding implementation of Keycloak where the custom DEFLATE compression and decompression helpers fail to release native zlib memory after use. An unauthenticated attacker can exploit this by sending repeated malformed SAML requests, leading to native memory exhaustion and a denial of service.

A flaw was found in the group policy provider of Keycloak authorization services, which is used to manage fine-grained access control to resources. The issue occurs when the system evaluates group-based policies using tokens that only contain group names rather than full paths. If two groups in different parts of the organization share the same name, a user in the unauthorized group can be mistaken for a member of the authorized group. This can allow a user to gain unauthorized access to protected resources they should not be able to reach.

It was found that the cookie used for CSRF prevention in Keycloak was not unique to each session. An attacker could use this flaw to gain access to an authenticated user session, leading to possible information disclosure or further attacks.

A flaw was found in the required action provider mechanism of Keycloak. When an authorization request includes the kc_action query parameter set to a mandatory action already assigned to the user (such as profile verification or terms and conditions), Keycloak may skip these mandatory challenges and issue an authorization code.

A flaw was found in the UMA resource registration endpoint of the keycloak-services component. When remote resource management is enabled, an authenticated user with specific permissions can update resources they do not own by providing a target resource ID in a request.

A flaw was found in the secure-redirect-uris-enforcer client policy of Keycloak, an identity and access management solution. The issue occurs when the policy is configured to allow loopback addresses, as Keycloak resolves hostnames via DNS during validation. An attacker can bypass domain allowlist restrictions by using a hostname that resolves to a loopback address, potentially allowing the registration of unauthorized redirect URIs.

In the HOTP authentication mechanism of keycloak-services, the system validates a one-time password and updates its internal counter in two separate steps without proper locking. An attacker with a user's password can exploit this timing gap to use a single one-time code to log in multiple times simultaneously.

In the Pushed Authorization Request (PAR) implementation of keycloak-services, restarting an authentication flow incorrectly clears the internal markers tracking PAR consumption while leaving the request active. An attacker can reuse the same authorization request to obtain multiple access tokens, bypassing single-use requirements.

In the client registration component of Keycloak, when a vault provider is used to store sensitive information, an authenticated client owner can use a specially crafted reference to reveal secrets. By updating a client secret to point to a vault entry and then requesting the client configuration, the owner can see the secret value in plain text.

In the JWT Authorization Grant implementation of keycloak-services, when an OIDC or Google identity provider is configured with login restrictions such as claim filtering, these checks are applied during standard browser logins but skipped during the JWT-based grant flow. This allows an authenticated client to obtain access tokens for a user even if their identity provider claims should have blocked the login.

A flaw was found in the Update User Locale required action of the Keycloak identity and access management solution. When this action is ordered before the Configure OTP action in a realm, the system may fail to enforce mandatory multi-factor authentication enrollment during the login process. This issue allows an attacker with a valid password to access an account without setting up the required one-time password (OTP) credential.

A flaw was found in the Client-Initiated Backchannel Authentication (CIBA) implementation within the keycloak-services component of Keycloak. Keycloak fails to verify that a client is authorized to use the CIBA flow, allowing public clients to bypass security requirements. An attacker could trick a user into approving a login request, eventually gaining full access to the user's account without needing a client secret.

A flaw in the login theme rendering component of Keycloak. The security filter responsible for cleaning user input can be bypassed, allowing a realm administrator to store malicious scripts in display fields. This could result in unauthorized JavaScript execution in the browsers of users visiting the login page.

A flaw in the OIDC Dynamic Client Registration (DCR) component of Keycloak causes the backchannel logout offline token revocation setting to be omitted from responses. When a client performs a standard update, this missing information causes the setting to be silently disabled. As a result, offline tokens may remain valid even after a user session is terminated via backchannel logout.

A flaw in the installation provider and client registration endpoints of Keycloak allows a realm administrator with only the read-only view-clients role to access the active primary secret of any confidential client, which should normally be restricted. This exposed secret can be used to impersonate the client and gain unauthorized access to its associated service account permissions.

A flaw in the SMTP email configuration handling of the keycloak-services component. When STARTTLS is enabled, Keycloak fails to strictly enforce an encrypted connection, allowing fallback to unencrypted communication if the encryption request is tampered with. An attacker who can intercept network traffic could capture sensitive email credentials and message content in plain text.

In the OIDC implementation of Keycloak, specifically in the Device Authorization Grant flow, the minimum authentication level required by a client configuration is not checked. This allows an attacker who has stolen a user's password to bypass mandatory multi-factor authentication and gain unauthorized access to the Keycloak Admin REST API.

A flaw was found in the Dynamic Client Registration flow of the Keycloak identity and access management server. The registration process fails to filter security-sensitive client attributes when a new client is created. An attacker with a valid Initial Access Token can register a client that bypasses audience checks during token introspection, allowing them to view sensitive identity information, roles, and session details from access tokens belonging to other applications in the same realm.

A flaw was found in the User Session Note mapper of the Keycloak identity and access management solution. The mapper does not validate whether a requested session note contains sensitive internal credentials, such as federated access tokens from external identity providers. This allows a delegated client administrator to leak a user's upstream bearer tokens into the tokens issued to their managed application.

A flaw was found in the X.509 client-certificate authenticator of Keycloak. The issue occurs when the server is configured to check certificate revocation using CRL Distribution Points or OCSP. An attacker can provide a specially crafted certificate that points to a malicious server, causing Keycloak to make unauthorized outbound requests to internal or external endpoints before the certificate is fully validated.

A flaw was found in the X.509 client certificate authenticator of Keycloak. When CRL Distribution Point checking is enabled, the server fails to properly validate the file paths provided in a client certificate. An attacker can provide a specially crafted certificate that causes the server to attempt to read sensitive files from the local system or exhaust memory by loading extremely large files, potentially leading to information disclosure or a system crash.

A flaw in the Fine-Grained Admin Permissions (FGAP v2) feature of Keycloak occurs because the system does not inspect composite roles when checking whether a delegated administrator may assign a specific role. An administrator with limited rights can assign a role that secretly includes full administrative control.

Keycloak's mTLS holder-of-key binding ensures a token can only be used by the client that requested it by binding it to their certificate. The new Standard Token Exchange V2 feature does not check for this certificate, allowing an attacker with stolen client credentials to obtain a standard, unrestricted token.

A flaw was found in the Admin REST API of Keycloak, an identity and access management solution. The endpoints used to retrieve groups associated with a specific role do not properly check individual group visibility permissions. This allows a delegated administrator with basic search privileges to view detailed information about all groups assigned to a role, bypassing intended security restrictions.

A flaw was found in the user update mechanism of the Keycloak Admin REST API. When Fine-Grained Admin Permissions are enabled, the system fails to check for specific password reset authorizations during a general user profile update. This allows a delegated administrator, who should be restricted from resetting passwords, to change a user's credentials and take over their account.

A flaw was found in the Level of Authentication enforcement mechanism of Keycloak. The issue occurs when a client specifically requires a higher security level for a user who already has an active session at a lower level. Due to a logic error in how session re-evaluations are handled, Keycloak may incorrectly issue a token at the lower security level instead of enforcing the required higher level, potentially allowing unauthorized access to sensitive resources that rely on these security claims.

Vulnerability in Keycloak's Pushed Authorization Request (PAR) implementation. When silent authentication (prompt=none) is used, the authorization process skips certain steps, failing to enforce that a pushed request URI is used only once. An attacker can reuse the URI to obtain multiple authorization codes for a logged-in user, violating security standards like FAPI-2.

Vulnerability in Keycloak's Conditional OTP authenticator. The system evaluates specific HTTP headers to decide whether to skip OTP but does not verify if those headers are from a trusted source. An attacker with the user's password can bypass second-factor authentication by providing a crafted header.

A flaw was found in the Kerberos federation provider of Keycloak. When Kerberos password authentication is used without SPNEGO, the system fails to verify the identity of the Key Distribution Center (KDC), allowing an attacker on the same network to spoof the KDC and bypass authentication.

A flaw was found in the authentication session management of Keycloak. When an administrator enforces a stronger authentication flow, such as mandatory 2FA setup, a user can bypass this requirement by manually visiting a specific session restart web link during login. This clears internal markers tracking required security steps, allowing login with only a password.

A flaw was found in the User-Managed Access (UMA) implementation of Keycloak. In the authorization token endpoint, when processing permission tickets, if two different users own resources with the same name, the system incorrectly merges permissions from both resources. This allows an attacker to gain access scopes on a victim's resource that were never intended to be shared.

A flaw was found in the Admin REST API of Keycloak. The issue occurs because the API uses a per-request in-memory cache to resolve clients by their unique identifier without verifying if the client belongs to the realm specified in the request path. This allows an administrator with limited privileges to read or modify sensitive client configurations in the master realm by accessing them through a realm they control.

A flaw was found in the Authorization Services component of Keycloak. The issue occurs in the policy evaluation endpoint, which is used by administrators to test how access policies apply to specific users. Due to missing authorization checks, a delegated administrator with limited viewing privileges can access the full profile and role information of any user in the realm, even if they are not permitted to view user details.

A flaw was found in the Admin REST API of Keycloak, an open-source identity and access management solution. The endpoint used for deleting user credentials does not correctly check for fine-grained reset-password permissions. This allows a delegated administrator, who should be restricted from resetting passwords, to delete a user's password credentials, resulting in the user being unable to log in.

A flaw was found in the Admin REST API of Keycloak, an open-source identity and access management solution. The issue occurs in the group-membership endpoints where the system fails to check if a group grants administrative privileges before allowing a user to be added. This allows a delegated administrator with limited permissions to add themselves to a high-privilege group, potentially gaining full control over the entire realm.

A flaw was found in the OIDC protocol implementation of Keycloak, an open-source identity and access management solution. The issue occurs during the token refresh process when the server restores requested audiences from stored client IDs. Keycloak fails to verify if the target audience client is still enabled before issuing a new access token. This allows an application with an existing refresh token to continue obtaining valid access tokens for a disabled client, potentially bypassing administrative access controls for resource servers that rely on offline JWT validation.

In Keycloak deployed in stateless mode with MySQL or MariaDB, a mismatch in row-count semantics between the database driver and Keycloak's application logic allows an attacker to bypass replay protection. This vulnerability enables an attacker who intercepts single-use security artifacts, such as JWT client assertions, DPoP proofs, or one-time password (TOTP) codes, to replay them. Successful exploitation grants unauthorized access to the token endpoint or login flow.

Keycloak's policy enforcer fails to correctly normalize web addresses containing special encoded characters, such as those representing semicolons or directory traversal segments. An authenticated user can use these encoded characters to trick the enforcer into applying a less restrictive security policy than intended, potentially gaining unauthorized access to sensitive administrative or private application endpoints.

A flaw was found in the first broker login flow of Keycloak. When a user confirms an account-linking request from a different browser, a temporary proof is created to validate the link. However, this proof is not properly cleared after the link is established or when the user later manually removes the link. An attacker who controls the external identity can exploit this leftover proof to silently re-establish the link and gain unauthorized access to the victim's account without any further confirmation.

A flaw was found in the Dynamic Client Registration service of Keycloak. When a user with the view-clients role accesses the client registration endpoint to retrieve client details, the service returns the client's confidential secret in cleartext due to a failure to mask sensitive information.

A flaw in the Device Authorization Grant flow of Keycloak occurs because the token redemption process fails to check whether a user account is currently locked due to brute-force protection. If an attacker has an active session for a locked account, they can complete the device login process and receive new security tokens.

A flaw was found in the first-broker-login flow of the Keycloak identity management service. When a user links a social identity provider account to their local account, the verification proof generated is not strictly bound to the specific upstream identity being verified. This allows an attacker with a different account on the same social provider to intercept the process and link their own account to the victim's local profile, gaining unauthorized access.

A flaw was found in the JWT Bearer authorization grant implementation within the keycloak-services component of Red Hat Build of Keycloak. The grant fails to check if a client requires user consent before issuing a token. This allows an authenticated attacker with valid client credentials and a trusted identity provider assertion to bypass the consent requirement and obtain unauthorized access to a user account at a consent-gated client.

Keycloak contains a vulnerability in the legacy account-linking endpoint, where the protection mechanism based on a hash can be predicted by a malicious OIDC client. An attacker can forge a linking URL to connect the victim's account to an attacker-controlled external identity, leading to full account takeover.

In the SAML broker component of Keycloak, when configured with IdP-Initiated flow, the OneTimeUse condition in SAML assertions is not enforced. This allows an attacker who captures a valid, unused assertion to replay it multiple times, potentially hijacking a user's session.

A flaw in the SAML broker component of Keycloak, used for identity federation and user authentication. The IdP-initiated Single Sign-On endpoint fails to check if a provider is restricted to account linking only, allowing an attacker with control over a linked upstream identity to bypass login restrictions and gain full access to a local user account.