Description

A flaw was found in the User-Managed Access (UMA) implementation of Keycloak. The issue occurs in the authorization token endpoint when processing permission tickets. If two different users own resources with the same name, the system incorrectly merges the permissions from both resources when one user requests an authorization token. This allows an attacker to gain access scopes on a victim's resource that were never intended to be shared.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.5",
  "pubDate": "2026-09-21T07:16:54.430Z",
  "pubdate": "2026-09-21T07:16:54.430Z",
  "executiveSummary": "A critical authorization bypass vulnerability exists within the User-Managed Access (UMA) implementation of Keycloak. This flaw manifests in the authorization token endpoint during the processing of permission tickets.\nThe vulnerability occurs due to improper resource identification logic, where the system incorrectly aggregates permissions based on shared resource naming conventions rather than unique resource identifiers.\nThis allows an attacker to gain unauthorized access to scopes on a victim's protected resources. An attacker with access to their own resources can induce the system to grant them elevated permissions for a target user's resource if they share an identical name.\nThe impact includes a significant loss of confidentiality and integrity of protected resources. This vulnerability represents a failure of the authorization framework to correctly isolate ownership boundaries in multi-tenant environments.\nThe risk is elevated as it requires no elevated privileges for the attacker, only the ability to interact with the UMA authorization endpoint. Organizations relying on Keycloak for granular access control are potentially exposed to unauthorized data access and privilege escalation.",
  "technicalDetails": "The root cause of this vulnerability lies in the logic governing the permission ticket validation process within the Keycloak UMA authorization flow. When a client requests an authorization token via the UMA endpoint, the authorization server must evaluate the requested scopes against the specific resource owned by the resource owner.\nThe implementation fails to enforce a strict binding between the Resource ID and the owner context when multiple resources share the same name. Instead, the backend authorization logic performs a lookup that inadvertently merges permission policies across different ownership domains.\nThe attack flow proceeds as follows: First, an attacker identifies a target resource owned by a victim that shares a common naming pattern with a resource the attacker owns or can influence. Second, the attacker initiates a standard UMA authorization request targeting their own resource.\nDuring the processing of the permission ticket, the Keycloak authorization server performs a database query or lookup that is indexed or filtered primarily by resource name rather than by a unique resource identifier tied to the authenticated user context. This causes the system to retrieve an aggregated set of permission scopes that includes those associated with the victim's resource.\nConsequently, the authorization server issues a Requesting Party Token (RPT) that contains the escalated permissions or scopes inadvertently merged from the victim's resource. The attacker can then present this RPT to the Resource Server (RS) to access the victim's data or perform unauthorized operations, as the RS validates the RPT based on the scopes contained within the token.\nThis flaw effectively bypasses the UMA protocol requirement that permissions must be tied to a specific resource owner. Because the vulnerability exists within the core authorization logic of the Keycloak server, it affects any deployment utilizing the UMA protocol features regardless of the specific client-side implementation.\nThe attack does not require prior knowledge of the victim's internal UMA ticket IDs, only the ability to craft requests that trigger the faulty name-based resolution logic. Exploitation occurs entirely over the network via the standard OAuth2/UMA endpoints, making it highly accessible to any authenticated user within the realm."
}