Description

A flaw was found in the Admin REST API of Keycloak, an open-source identity and access management solution. The endpoint used for deleting user credentials does not correctly check for fine-grained reset-password permissions. This allows a delegated administrator, who should be restricted from resetting passwords, to delete a user's password credentials, resulting in the user being unable to log in.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-09-19T15:17:08.903Z",
  "pubdate": "2026-09-19T15:17:08.903Z",
  "executiveSummary": "A broken access control vulnerability exists within the Admin REST API of Keycloak, specifically concerning the management of user credentials.\nThe vulnerability allows an authenticated delegated administrator, who possesses limited administrative scope, to bypass defined permission checks when interacting with the password credential deletion endpoint.\nBy successfully exploiting this flaw, a malicious or compromised delegated administrator can unilaterally delete a user's password credentials, effectively triggering a denial-of-service condition for the target user by rendering their authentication impossible.\nThe vulnerability resides in the authorization logic governing the credential lifecycle management, where the system fails to validate fine-grained reset-password permissions prior to executing the deletion request.\nThis represents a significant security risk to identity integrity and availability, as administrative delegation policies are circumvented. Exploitation requires the attacker to hold existing, though restricted, administrative privileges within the Keycloak environment.",
  "technicalDetails": "The vulnerability is rooted in an improper authorization check within the Admin REST API component of Keycloak. Specifically, the API endpoint responsible for processing the deletion of user credentials lacks a verification step against the fine-grained 'reset-password' permission model.\nIn Keycloak's security architecture, administrative actions are governed by a granular permission system. Delegated administrators are intended to be restricted to specific management tasks. The identified flaw manifests when an administrator attempts to invoke the credential deletion function via the REST API.\nThe attack flow proceeds as follows: An authenticated delegated administrator, who is unauthorized to modify user passwords, crafts an API request targeting the credential management endpoint of a specific user. Because the application logic relies on an insufficient check, the backend service assumes the caller is authorized to manipulate credentials based on the broader administrative context rather than verifying the specific permission required to delete passwords.\nUpon receiving the request, the API processes the deletion command against the underlying data store, removing the user's password credential. The root cause is the failure of the service layer to validate that the caller's session scope includes the precise authorization grant necessary to execute a destructive credential operation.\nThis does not require network-level access beyond what is necessary to interact with the Admin REST API; it is a logic-based privilege escalation or authorization bypass. Once the request is executed, the impact is immediate: the user loses their password credential, preventing successful authentication. This effectively locks the user out of the system, requiring manual intervention by an authorized system administrator to restore access.\nThe flaw highlights a disconnect between the API interface security controls and the backend permission enforcement engine, which must be synchronized to ensure that all destructive operations, such as password deletion, are gated by the correct fine-grained permission flags. As the system fails to perform this validation, it allows unauthorized modification of identity data."
}