Keycloak vulnerabilities

In org.keycloak.services, an administrator with delegated access to read group memberships and users can bypass user profile permissions by accessing the group members endpoint, allowing them to view user attributes that are explicitly denied.

A flaw was found in Keycloak where, with revokeRefreshToken=true enabled and persistent session storage in use, a server restart can reset internal timing mechanisms, allowing a remote attacker who has captured a user's refresh token to replay it even after revocation.

A flaw was found in Keycloak where a remote attacker with high privileges (e.g., a realm administrator configuring a malicious LDAP server or an attacker compromising an upstream LDAP server) can trigger an OutOfMemoryError by sending a malformed LDAP password policy response during a password authentication request. This causes the Keycloak JVM to terminate, leading to a denial of service (DoS) for all realms on the affected node.

A flaw was found in Keycloak's Fine-Grained Admin Permissions (FGAPv2) feature. An administrator with limited client management permissions can assign any realm role, including highly privileged ones, to a client's scope mapping. This bypasses security controls and injects the role into a user's authentication token.

A flaw was found in Keycloak where an authenticated user with existing organization membership can disclose organization metadata in OIDC tokens or via the account API, even after the administrator has disabled the Organizations feature, potentially leading to incorrect authorization decisions by resource servers.

In Keycloak, the cross-session verification proof is keyed only by (localUserId, idpAlias) and is not bound to the upstream identity. A second upstream account on the same IdP can consume it and get linked to the victim's local account.

A session fixation vulnerability was found in Keycloak's login-actions endpoints. An unauthenticated attacker can pre-create an authentication session and trick a victim into clicking a malicious link, allowing the attacker to hijack the required-action form without the victim's credentials. Successful exploitation could lead to complete account takeover, including highly privileged administrative accounts.

A flaw was found in Keycloak's URL validation logic during redirect operations. By crafting a malicious request, an attacker could bypass validation to redirect users to unauthorized URLs, potentially leading to the exposure of sensitive information within the domain or facilitating further attacks. This vulnerability specifically affects Keycloak clients configured with a wildcard (*) in the "Valid Redirect URIs" field and requires user interaction to be successfully exploited.

A flaw was found in Keycloak where a remote, unauthenticated attacker can send a specially crafted XML input to the SAML endpoint, causing high CPU usage and worker thread starvation, leading to a Denial of Service (DoS) and server unavailability.

In Keycloak, when both realm-level and client-level `notBefore` revocation policies are configured, the OIDC Introspection feature fails to honor the realm-level policy, leaving tokens that should be revoked active.

An authenticated user can bypass configured WebAuthn policies during credential registration by manipulating client-side JavaScript. The server fails to validate that the new credential's parameters match the realm's WebAuthn policies.

A flaw in Keycloak allows an authenticated user with the uma_protection role to bypass User-Managed Access (UMA) policy validation. The attacker can include resource identifiers owned by other users in a policy creation request, even if the URL path specifies an attacker-owned resource. This leads to unauthorized access to sensitive information or unauthorized actions.

A flaw in Keycloak allows an unauthenticated attacker to cause a Denial of Service (DoS) by sending a crafted POST request with an excessively long scope parameter to the OIDC token endpoint, leading to high resource consumption and prolonged processing.

A flaw was found in Keycloak's SingleUseObjectProvider, a global key-value store lacking proper type and namespace isolation. This allows an attacker to delete arbitrary single-use entries, enabling replay of consumed action tokens such as password reset links, potentially leading to unauthorized access or account compromise.

A flaw in Keycloak's SingleUseObjectProvider, a global key-value store, lacks proper type and namespace isolation, allowing an unauthenticated attacker to forge authorization codes.

A flaw was found in Keycloak allowing an attacker controlling another path on the same web server to bypass the allowed path in redirect URIs using a wildcard. A successful attack may lead to theft of an access token and information disclosure.

A flaw was found in Keycloak. An authenticated attacker can perform Server-Side Request Forgery (SSRF) by manipulating the `client_session_host` parameter during refresh token requests. This occurs when a Keycloak client is configured to use the `backchannel.logout.url` with the `application.session.host` placeholder.

A flaw was found in Keycloak. A remote attacker can exploit differential error messages during the identity-first login flow when Organizations are enabled. This vulnerability allows an attacker to determine the existence of users, leading to information disclosure through user enumeration.

A flaw was found in Keycloak: an improper access control vulnerability in the User-Managed Access (UMA) resource_set endpoint allows attackers with valid credentials to bypass the allowRemoteResourceManagement=false restriction. This occurs due to incomplete enforcement of access control checks on PUT operations to the resource_set endpoint, enabling unauthorized modification of protected resources and impacting data integrity.

A flaw was identified in Keycloak, an identity and access management solution, where it improperly follows HTTP redirects when processing certain client configuration requests. This behavior allows an attacker to trick the server into making unintended requests to internal or restricted resources.

A flaw was found in Keycloak where a remote attacker can bypass security controls by sending a valid SAML response from an external Identity Provider (IdP) to the Keycloak SAML endpoint for IdP-initiated broker logins. This allows the attacker to complete broker logins even when the SAML Identity Provider is disabled, leading to unauthorized authentication.

A flaw in Keycloak's SAML broker endpoint fails to properly validate encrypted assertions when the overall SAML response is unsigned. An attacker with a valid signed assertion can inject an encrypted assertion for an arbitrary principal.

A flaw was found in Keycloak. An authorization bypass vulnerability in the Keycloak Admin API allows any authenticated user, even those without administrative privileges, to enumerate the organization memberships of other users. This information disclosure occurs if the attacker knows the victim's unique identifier (UUID) and the Organizations feature is enabled.

A flaw was identified in the Account REST API of Keycloak that allows a user authenticated at a lower security level to perform sensitive actions intended only for higher-assurance sessions. Specifically, an attacker who has already obtained a victim’s password can delete the victim’s registered MFA/OTP credential without first proving possession of that factor. The attacker can then register their own MFA device, effectively taking full control of the account. This weakness undermines the intended protection provided by multi-factor authentication.

A flaw was found in the org.keycloak.broker.saml component. When a disabled SAML client is configured as an IdP-initiated broker landing target, it can still complete the login process and establish an SSO session. This allows a remote attacker to gain unauthorized access to other enabled clients without re-authentication, bypassing security restrictions.

A vulnerability in Keycloak allows authentication through a disabled Identity Provider (IdP) by reusing a previously generated login request. An attacker knowing the IdP alias can bypass the administrative restriction and gain access.

A flaw was found in Keycloak's WebAuthn registration component. This vulnerability allows an attacker to bypass the configured attestation policy and register untrusted or forged authenticators via submission of an attestation object with fmt: "none", even when the realm is configured to require direct attestation. This can lead to weakened authentication integrity and unauthorized authenticator registration.

A flaw in Keycloak discloses sensitive headers, including Authorization and Cookie, in cleartext to logs when the logging format is configured to a verbose, user-supplied pattern (such as the predefined 'long' pattern). An attacker with read access to log files can extract credentials (bearer tokens, session cookies) and impersonate users, leading to full account compromise.

A flaw in Keycloak allows an attacker to modify the organization ID and target email in a valid invitation JWT token. Lack of cryptographic signature verification enables self-registration into an unauthorized organization.

A flaw was found in Keycloak in the jwt-authorization-grant flow where the server fails to verify if an Identity Provider (IdP) is enabled before issuing tokens. The issuer lookup mechanism retrieves the IdP configuration but does not filter for isEnabled=false. An entity possessing the signing key of a disabled IdP can still generate valid JWT assertions that Keycloak accepts, resulting in valid access tokens.

This CVE number has been rejected. After further review by the Keycloak project and Red Hat, the reported SSRF via client registration/backchannel notification URIs was determined not to constitute a security vulnerability. The reported behavior is expected administrator-controlled functionality, and Keycloak provides documented mitigations through Client Policies.

A flaw was found in Keycloak. This improper input validation vulnerability occurs because Keycloak accepts RFC-compliant matrix parameters in URL path segments, while common reverse proxy configurations may ignore or mishandle them. A remote attacker can craft requests to mask path segments, potentially bypassing proxy-level path filtering. This could expose administrative or sensitive endpoints that operators believe are not externally reachable.

A flaw was found in Keycloak regarding the authorization header parser. This parser is overly permissive regarding the formatting of the 'Bearer' authentication scheme, accepting non-standard characters as separators and tolerating case variations that deviate from RFC 6750 specifications.

A flaw was found in Keycloak. An IDOR (Broken Access Control) vulnerability exists in the admin API endpoints for authorization resource management, specifically in ResourceSetService and PermissionTicketService. The system checks authorization against the resourceServer (client) ID provided in the API request, but the backend database lookup and modification operations (findById, delete) only use the resourceId. This mismatch allows an authenticated attacker with fine-grained admin permissions for one client (e.g., Client A) to delete or update resources belonging to another client (Client B) within the same realm by supplying a valid resource ID.

A flaw was found in Keycloak Admin REST API. This vulnerability allows information disclosure of sensitive role metadata via insufficient authorization checks on the /admin/realms/{realm}/roles endpoint.

A flaw in Keycloak's LDAP User Federation provider allows an authenticated realm administrator to trigger deserialization of untrusted Java objects via a malicious LDAP server configuration.

In Keycloak's server distribution, enabling debug mode (--debug <port>) insecurely defaults to binding the JDWP port to all network interfaces (0.0.0.0), exposing the debug port to the local network.

In Keycloak, a user can accidentally get access to another user's session if both use the same device and browser. This happens because Keycloak sometimes reuses session identifiers and doesn't clean up properly during logout when browser cookies are missing. As a result, one user may receive tokens that belong to another user.

A flaw was found in Keycloak. The Keycloak guides recommend not to expose the /admin path to the outside when using a proxy. The issue occurs at least via ha-proxy, as it can be tricked into using relative/non-normalized paths to access the /admin application path relative to /realms, which is expected to be exposed.

In Keycloak, an offline session remains valid when the offline_access scope is removed from the client. The refresh token is still accepted and new tokens can continue to be requested for the session.

A flaw was found in Keycloak. Keycloak does not immediately enforce the disabling of the "Remember Me" realm setting on existing user sessions. Sessions created while "Remember Me" was active retain their extended session lifetime until they expire, overriding the administrator's recent security configuration change. This logic flaw in session management increases the potential window for successful session hijacking or unauthorized long-term access persistence.

In Keycloak, the account console and other pages accept arbitrary text in the error_description query parameter, which is rendered without validation or sanitization. While HTML encoding prevents XSS, an attacker can craft URLs with misleading messages (e.g., fake support phone numbers or URLs) displayed within the trusted Keycloak UI.

A flaw was found in Keycloak that allows an authenticated attacker to merge their account with an existing victim's account during identity provider login. The attacker can change their email address to that of the victim, triggering a verification email to the victim.

A flaw was found in Keycloak where the org.keycloak.authorization package may be vulnerable to circumventing required actions, allowing users to bypass requirements such as setting up two-factor authentication.

A flaw was found in Keycloak where JWT tokens used for authentication are cached until expiration. If a client uses JWT tokens with excessively long expiration times (e.g., 24 or 48 hours), the cache can grow indefinitely, leading to an OutOfMemoryError.

A flaw was found in the Keycloak organization feature, which allows incorrect assignment of an organization to a user if their username or email matches the organization's domain pattern. This occurs at the mapper level, leading to misrepresentation in tokens.

A flaw was found in Keycloak where when an Active Directory user resets their password, the system updates it without performing an LDAP bind to validate the new credentials. This allows users with expired or disabled AD accounts to regain access in Keycloak, bypassing AD restrictions.

A vulnerability was found in Keycloak where admin users may access sensitive server environment variables and system properties through user-configurable URLs. When configuring backchannel logout URLs or admin URLs, admins can include placeholders like ${env.VARNAME} or ${PROPNAME}, which the server replaces with actual values during URL processing.

A denial of service vulnerability was found in Keycloak that could allow an administrative user with the right to change realm settings to disrupt the service. This is done by modifying security headers and inserting newlines, causing the server to write to a terminated request, leading to failure.

A vulnerability was found in Keycloak where the environment option `KC_CACHE_EMBEDDED_MTLS_ENABLED` does not work and the JGroups replication configuration is always used in plain text, which can allow an attacker with access to adjacent networks related to JGroups to read sensitive information.