Description

A flaw was found in the Admin REST API of Keycloak, an open-source identity and access management solution. The issue occurs because the API uses a per-request in-memory cache to resolve clients by their unique identifier without verifying if the client belongs to the realm specified in the request path. This allows an administrator with limited privileges to read or modify sensitive client configurations in the master realm by accessing them through a realm they control. Successful exploitation could lead to the exposure of client credentials or the redirection of administrative login attempts to malicious sites.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.5",
  "pubDate": "2026-09-21T07:16:54.307Z",
  "pubdate": "2026-09-21T07:16:54.307Z",
  "executiveSummary": "A critical authorization flaw exists within the Keycloak Admin REST API, classified as a cross-realm resource access vulnerability. The vulnerability stems from an insecure object lookup mechanism that fails to enforce realm-based boundary checks during per-request client resolution.\nBy manipulating the request path to reference a realm under the attacker's control while targeting a client UUID belonging to the master realm, a low-privileged administrator can bypass security constraints. This allows for unauthorized read and modification of sensitive client configurations residing in the master realm.\nThe impact includes the exposure of confidential client credentials, secret rotation, and the potential for malicious redirection of administrative traffic. Attackers must possess administrative privileges within an existing realm to leverage this flaw. The vulnerability undermines the multi-tenant isolation model of Keycloak, posing a severe risk to administrative security and authentication integrity.",
  "technicalDetails": "The root cause of this vulnerability lies in the improper implementation of the client resolution logic within the Keycloak Admin REST API. When processing administrative requests, the API utilizes a per-request in-memory cache to resolve client entities via their unique identifier. Crucially, this resolution process does not validate that the resolved client object is cryptographically or logically associated with the specific realm defined in the URI path.\nThe attack flow proceeds as follows: 1) The attacker, possessing valid administrative credentials for a non-master realm, identifies a target client UUID within the master realm. 2) The attacker crafts an administrative API request targeted at their own controlled realm but substitutes the client parameter with the UUID of the target resource located in the master realm. 3) The backend API, performing the lookup through the shared in-memory cache, retrieves the master realm client object because the cache lookup mechanism lacks a realm-scoped key or a secondary authorization check against the requested resource's owner.\nBecause the validation check is absent at the controller or service layer, the application proceeds to execute administrative actions—such as GET or PUT operations—against the improperly accessed object. This effectively treats the cross-realm resource as if it were a local resource within the attacker's authorized realm.\nThe exploitation method essentially facilitates an Insecure Direct Object Reference (IDOR) scenario accelerated by flawed caching logic. The technical requirement for exploitation is a valid session in any realm; however, the impact is escalated to the master realm, which typically governs the security configuration of the entire Keycloak instance. Post-exploitation impact includes the modification of client secrets or URI settings, which can be leveraged to intercept authorization codes or divert OAuth2 flow redirects to attacker-controlled infrastructure, potentially leading to a total compromise of administrative authentication flows."
}