Description

A flaw was found in Keycloak's administrative services (org.keycloak.services.resources.admin). A highly privileged attacker, authenticated with a 'manage-clients' role, could exploit this vulnerability through several methods, including manipulating client JSON Web Key Sets (JWKS), swapping client authenticator types and resetting secrets, or downloading legitimate signing keys. Successful exploitation allows the attacker to obtain a token with 'realm-admin' role assignments, leading to privilege escalation and potential unauthorized access to sensitive resources.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-11-06T07:18:06.340Z",
  "pubdate": "2026-11-06T07:18:06.340Z",
  "executiveSummary": "This vulnerability involves an authorization bypass within Keycloak's administrative services, specifically located in org.keycloak.services.resources.admin. It is classified as a privilege escalation flaw allowing an attacker with existing 'manage-clients' permissions to elevate their status to 'realm-admin'.\nThe vulnerability arises from improper validation of administrative actions concerning client configurations. By manipulating client-specific security metadata—such as JSON Web Key Sets (JWKS), authenticator types, or signing keys—an authenticated attacker can subvert internal access control checks.\nThe impact is significant, as successful exploitation results in full administrative control over the target realm, potentially leading to total compromise of sensitive user data, system configuration, and integrated resources.\nExploitation requires the attacker to possess a 'manage-clients' role, meaning this is an insider threat or an account takeover scenario rather than an unauthenticated remote execution. The threat landscape is characterized by the potential for lateral movement and complete identity provider compromise once the realm-admin role is acquired.",
  "technicalDetails": "The vulnerability resides within the org.keycloak.services.resources.admin package, which manages administrative operations for client resources. The flaw stems from insufficient enforcement of security constraints when processing modifications to client security settings.\nAn attacker possessing the 'manage-clients' role can interact with the Admin REST API to perform unauthorized modifications to client-related security structures. The attack flow involves the systematic manipulation of cryptographic material and authentication mechanisms. Specifically, an attacker can modify the JSON Web Key Sets (JWKS) associated with a client, swap legitimate client authenticator types, or force a reset of client secrets. By strategically altering these values, the attacker interferes with the trust chain used by Keycloak to validate administrative tokens and service-to-service communication.\nUpon performing these modifications, the attacker can manipulate the authentication flow to receive a valid session token that incorporates elevated, unintended privileges. Through the replacement of public keys or the subversion of authentication strategies, the attacker forces the underlying security logic to authorize their session with the 'realm-admin' role, bypassing the intended restrictive scope of the 'manage-clients' role.\nThe vulnerability leverages the trust Keycloak places in the metadata provided through the administrative interface. Because the system fails to correctly validate the legitimacy of these configuration changes against the caller's authorized scope, the attacker is able to elevate their privileges within the realm context. Post-exploitation, the attacker effectively acts as a realm-level administrator, enabling them to alter user accounts, modify realm policies, and access sensitive administrative functions that should be strictly gated behind the 'realm-admin' role.\nThis issue represents a failure in state management and access control within the administrative resource handlers. By subverting the client-specific signing keys or authentication definitions, the attacker compromises the integrity of the token issuance process. As the 'realm-admin' role grants broad capabilities within the identity provider, this privilege escalation permits the adversary to maintain persistent, unauthorized access to the entire Keycloak instance’s managed resources, effectively neutralizing the isolation between different administrative tiers."
}