Description

A flaw was found in the user update mechanism of the Keycloak Admin REST API. When Fine-Grained Admin Permissions are enabled, the system fails to check for specific password reset authorizations during a general user profile update. This allows a delegated administrator, who should be restricted from resetting passwords, to change a user's credentials and take over their account.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.6",
  "pubDate": "2026-09-24T06:17:04.380Z",
  "pubdate": "2026-09-24T06:17:04.380Z",
  "executiveSummary": "A critical authorization flaw exists within the Keycloak Admin REST API regarding the user update mechanism. Specifically, when Fine-Grained Admin Permissions are enabled, the application fails to enforce granular authorization checks for credential management operations during general user profile updates.\nThis vulnerability allows an authenticated delegated administrator, restricted from performing password resets, to manipulate user credentials and successfully perform account takeover. The flaw exposes a significant breakdown in the Principle of Least Privilege, as the API incorrectly validates the scope of the administrative session.\nThe impact is severe, potentially leading to unauthorized access to any user account managed by the delegated administrator. Exploitation requires existing authenticated access as a delegated administrator and does not require elevated super-user privileges. The vulnerability represents a bypass of configured administrative access controls, undermining the integrity of identity management within the Keycloak deployment.",
  "technicalDetails": "The vulnerability resides within the user profile update endpoint of the Keycloak Admin REST API. When Fine-Grained Admin Permissions (FGAP) are enabled, Keycloak is intended to enforce specific permissions for administrative actions on target users. However, the system fails to verify whether the authenticated actor possesses the 'reset-password' authorization when a request is made to the general user update endpoint.\nThe root cause is a failure in the authorization logic layer of the REST API controller handling user updates. During the request processing lifecycle, the system performs a general check for update permissions but neglects to reconcile the request payload—which may contain credentials or password reset directives—against the specific functional permissions assigned to the delegated administrator.\nThe attack flow proceeds as follows: 1) An attacker possessing delegated administrative privileges (with permissions restricted to updating user attributes but excluding password reset) initiates a PUT or POST request to the Admin REST API user profile endpoint. 2) The attacker includes sensitive credential-related fields within the request body. 3) The API backend processes the update request, validating that the attacker has general user update rights, but failing to perform a secondary check against the 'reset-password' capability. 4) The Keycloak persistence layer updates the user record with the new credentials, effectively bypassing the security policy defined by the Fine-Grained Admin Permissions system.\nThe vulnerable component is the REST API request handler responsible for validating and executing user identity modifications. Because the authorization check is non-atomic and lacks granularity for sub-actions like password reset during a broader profile update, the system treats a privileged administrative operation as a standard attribute update.\nSuccessful exploitation results in full account takeover of any user within the scope of the delegated administrator. This bypasses the intended security segmentation, allowing the attacker to assume the identity of targeted users, access their associated application permissions, and compromise downstream services integrated with Keycloak."
}