org.keycloak:keycloak-services@26.7.2

org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services.

Affected versions of this package are vulnerable to Missing Authorization through the generic identity-provider creation and update paths in IdentityProvidersResource and IdentityProviderResource. An attacker can link or update an identity provider for an organization by sending an organizationId and organization-specific config in the administrative API request. This lets an administrator with only identity-provider management permission influence which organizations use that provider, affecting how users authenticate into those organizations and allowing unauthorized control over organization login routing.

A fix was pushed into the master branch but not yet published.

org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services.

Affected versions of this package are vulnerable to Replay Attack through IdP-initiated broker logins in the services/src/main/java/org/keycloak/broker/saml component. An attacker can hijack a user session and gain unauthorized access by resending a captured, valid SAML assertion that contains a OneTimeUse condition. When Keycloak accepts the assertion without tracking whether that assertion ID was already used, the same unused response can be replayed multiple times against the broker flow. This affects deployments using Keycloak as a SAML identity broker with IdP-initiated login enabled.

A fix was pushed into the master branch but not yet published.

org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services.

Affected versions of this package are vulnerable to Missing Authorization through the user creation path in UsersResource.create and RepresentationToModel.createGroups. An attacker can add a newly created user to groups they are not authorized to manage by submitting a user creation request with group memberships while FGAP V2 is enabled. This lets a sub-administrator who can create users place those users into restricted groups, exposing sensitive information or granting the new accounts elevated privileges.

A fix was pushed into the master branch but not yet published.

org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services.

Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key through the getRoleUserMembers path in RoleContainerResource in the keycloak-services admin API. An attacker can expose private user details by sending a GET /admin/realms/{realm}/roles/{role-name}/users request from a restricted admin account with permission to view the role but not individual users. The endpoint returns the full representation of role members without applying the per-user view filter, so user PII such as names and email addresses is disclosed for accounts the caller is not authorized to access.

A fix was pushed into the master branch but not yet published.

org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services.

Affected versions of this package are vulnerable to Missing Authorization through the TokenManager component in the identity management service. An attacker can continue using previously issued tokens by presenting them after an administrator applies a client-specific “not-before” revocation policy while the realm already has an older non-zero revocation policy in place. This leaves revoked tokens valid for refreshing sessions and accessing user information, so administrators cannot reliably invalidate a client’s existing tokens.

There is no fixed version for org.keycloak:keycloak-services.

org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services.

Affected versions of this package are vulnerable to Access Control Bypass through the Client-Initiated Backchannel Authentication token redemption handler in the keycloak-services component. An attacker can obtain access and refresh tokens for a locked user account by redeeming a previously started CIBA authentication request after the account has been locked, provided the request was approved by the user and the attacker has valid client credentials. The vulnerable code path lets token redemption proceed even when brute-force protection has already locked the account. This leaves users exposed to unauthorized token issuance for accounts that were expected to be blocked, undermining the lockout’s protection against continued authentication attempts.

There is no fixed version for org.keycloak:keycloak-services.

org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services.

Affected versions of this package are vulnerable to Reliance on Untrusted Inputs in a Security Decision through the client authentication flow in the client policies and assertion handling components. An attacker can authenticate with weaker client credentials by supplying a fake unsigned assertion header that makes the server believe the policy requirements have been satisfied. This defeats administrator-mandated requirements for signed JWT assertions and lets a client complete authentication with a simpler method such as a client secret, weakening client authentication controls.

There is no fixed version for org.keycloak:keycloak-services.

org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services.

Affected versions of this package are vulnerable to Information Exposure due to insufficient group-permission filtering in RealmAdminResource.getRealm(), RealmAdminResource.getDefaultGroups(), and RealmsAdminResource.toRealmRep() in the admin REST API. A delegated administrator can enumerate hidden default groups by requesting the realm representation or the default-groups endpoint after being granted realm-view permissions but denied per-group view access.

This exposes the names, paths, and identifiers of default groups that should remain hidden, revealing internal organizational structure to users who do not have permission to view those groups.

Notes

• FGAP v2 must be enabled for the hidden-default-group checks to matter; the issue is in the delegated-admin/admin-permissions path that evaluates realm and group view rights separately.
• The disclosure also affects the realm listing returned by admin/realms via RealmsAdminResource.toRealmRep(), not just the dedicated default-groups endpoint.

A fix was pushed into the master branch but not yet published.

org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services.

Affected versions of this package are vulnerable to Missing Authorization through the Google token exchange flow in the Google Identity Provider token exchange process. An attacker can gain access to a Keycloak realm by supplying a valid Google token from a non-approved Google Workspace domain and exchanging it for a Keycloak token. The issue affects deployments that rely on Google domain restrictions to limit which accounts may sign in, allowing users from disallowed domains to authenticate successfully.

There is no fixed version for org.keycloak:keycloak-services.

org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services.

Affected versions of this package are vulnerable to Missing Authorization in the admin REST API through the deleteComposites role-composite deletion path in RoleResource, RoleContainerResource, and RoleByIdResource. An attacker with limited administrative permissions can remove privileged child roles from a composite role by sending DELETE requests to the role composite endpoints. The vulnerable endpoints only checked manage permission on the parent role and did not enforce per-child role authorization before role.removeCompositeRole(composite). As a result, a delegated administrator can strip roles they are not authorized to map, breaking role assignments for other users and administrators and causing access loss.

A fix was pushed into the master branch but not yet published.

org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services.

Affected versions of this package are vulnerable to Improper Authentication through the Microsoft account token exchange flow in the Microsoft identity provider component. An attacker can gain unauthorized access to a Keycloak realm by supplying a valid Microsoft token from a different organization and exchanging it. This bypasses the tenant restriction intended to limit logins to a specific Microsoft organization, allowing access to sensitive data and unauthorized actions in deployments that rely on that restriction.

There is no fixed version for org.keycloak:keycloak-services.

org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services.

Affected versions of this package are vulnerable to Missing Authorization in the RoleContainerResource admin REST composite-role endpoints. A delegated administrator can remove child roles from built-in admin roles by sending name-based composite-role requests against the realm admin API, bypassing the per-role checks that should gate those updates. This can strip essential permissions such as manage-users, manage-clients, or impersonation from administrative roles, disrupting or degrading administrative access within the realm.

A fix was pushed into the master branch but not yet published.

org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services.

Affected versions of this package are vulnerable to Missing Authorization due to the full-scope-disabled client-policy executor. An attacker can create a client with full scope access by omitting the fullScopeAllowed field from a client registration or configuration request. This lets a delegated user obtain tokens with unauthorized role mappings for the resulting client. The impact is that clients are created with broader permissions than the policy allows, enabling access to roles the user should not be able to assign.

There is no fixed version for org.keycloak:keycloak-services.

org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services.

Affected versions of this package are vulnerable to Missing Authorization during client update handling. An attacker can persist a confidential client that does not meet the realm’s authentication requirements by creating a public client and then updating it to a confidential client with weaker authentication, if they have client management permissions. This affects realms that use client policies to enforce authentication hardening on confidential clients, leaving noncompliant clients in place instead of blocking the update.

There is no fixed version for org.keycloak:keycloak-services.

org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services.

Affected versions of this package are vulnerable to Information Exposure through the OIDCClientSecretConfigWrapper in services/src/main/java/org/keycloak/protocol/oidc/OIDCClientSecretConfigWrapper.java. An attacker can retrieve the resolved plaintext value of a vault-backed rotated client secret by calling the rotated client-secret Admin REST endpoint for a client configured with a vault placeholder. A delegated administrator with view-only access to client secret data receives the actual secret instead of the stored vault expression, exposing sensitive credentials and allowing unauthorized use of the client secret.

A fix was pushed into the master branch but not yet published.

org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services.

Affected versions of this package are vulnerable to Missing Authorization through the OIDC token introspection endpoint in the keycloak-services component. An attacker can access sensitive token claims by sending an introspection request for a token issued to a different audience from a confidential client configured to receive signed JWT introspection responses. The endpoint marks the token inactive for that client, but it still returns the token’s full claims inside the signed JWT response. This lets an unauthorized client recover audience-restricted token data that should not be exposed.

There is no fixed version for org.keycloak:keycloak-services.

org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services.

Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature in the backchannel logout endpoint of the keycloak-services component. An attacker can force a user to log out by sending a logout request without a cryptographic signature when an OIDC identity provider is configured to skip signature validation. This lets the attacker disrupt the user’s active session and break access to applications until the user signs in again.

There is no fixed version for org.keycloak:keycloak-services.

org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services.

Affected versions of this package are vulnerable to Information Exposure through the AuthenticationManagementResource in services/src/main/java/org/keycloak/services/resources/admin/AuthenticationManagementResource.java. An attacker can retrieve raw authenticator configuration secrets by requesting authentication config data through the admin API as a user with view-only permissions. The vulnerable GET paths return ModelToRepresentation.toRepresentation(config) without masking sensitive entries, so values such as reCAPTCHA secret keys are exposed in the response and can also appear in administrative logs. This leaks third-party service credentials to unauthorized administrators and can expose secrets used by the realm’s authentication flows.

Notes

• The leak is limited to the admin GET endpoints that return authenticator-config representations, so only deployments where administrators can view authentication configs through the admin API are exposed.
• The exposed values are those stored in authenticator config metadata, including provider-defined secrets and legacy/unknown keys that are not recognized as non-secret by the provider registry.

A fix was pushed into the master branch but not yet published.

org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services.

Affected versions of this package are vulnerable to Improper Validation of Consistency within Input in the identity provider update flow for OIDC identity providers. An attacker can capture the existing client secret by sending an update as a delegated administrator that reuses the masked client secret sentinel value while changing security-sensitive settings such as the token URL. The vulnerable code path manages identity provider configuration updates in keycloak-services, and it accepts the update without forcing the secret to be revalidated against the changed endpoint. This lets the attacker redirect secret-bearing requests to an endpoint they control and expose the real client secret, breaking the confidentiality of the identity provider credentials.

There is no fixed version for org.keycloak:keycloak-services.

org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services.

Affected versions of this package are vulnerable to DNS Rebinding in the client host restriction logic. An attacker can bypass wildcard domain restrictions on client registration or updates by controlling the reverse DNS for their connection and presenting a hostname that merely ends with the configured suffix, such as *.example.com, even when it is not a real subdomain. This lets an unauthorized party modify clients in realms that rely on host-based allowlists, breaking the intended restriction on who can register or update client settings.

There is no fixed version for org.keycloak:keycloak-services.

org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services.

Affected versions of this package are vulnerable to Improper Validation of Consistency within Input during OIDC authentication flow processing. An attacker can inject duplicate security parameters into the login response by supplying a crafted redirect URL with a fragment portion that bypasses the parameter-pollution check. If a client is configured with a wildcard redirect URI and the application trusts the injected values, the attacker can cause session fixation or account confusion, breaking the user’s login session and causing the app to associate the session with the wrong identity or security context.

There is no fixed version for org.keycloak:keycloak-services.

org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services.

Affected versions of this package are vulnerable to Improperly Implemented Security Check for Standard through the secure-client-uris client policy executor in the client configuration enforcement path. An attacker can bypass the redirect-URI security restriction by supplying a specially crafted domain name that satisfies the prefix check while pointing to an attacker-controlled host. This can let the attacker intercept authentication codes sent over an unencrypted connection, exposing users to account compromise during login flows.

There is no fixed version for org.keycloak:keycloak-services.

org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services.

Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key due to the OAuth 2.0 authorization code handling. An attacker can obtain access tokens for a victim’s identity by intercepting an authorization code and redeeming it with their own client. The affected code path does not bind the authorization code to the client that originally requested it, so a stolen code can be substituted during token exchange and used to log in as the victim.

There is no fixed version for org.keycloak:keycloak-services.

org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services.

Affected versions of this package are vulnerable to Insertion of Sensitive Information Into Sent Data through OrganizationInvitationResource.toRepresentation() in OrganizationInvitationResource.java. An attacker can retrieve the secret invitation link by creating or listing an organization invitation through the admin REST API, then use that link to register new accounts and add them to the organization without manage-users permission or access to the invited mailbox. This lets a delegated organization administrator bypass the intended invitation workflow and create unauthorized organization members.

Notes

• The leaked link was exposed in both the single-invitation get response and the invitations list response, so any caller with organization-invitation read access could recover it without going through the email-delivery path.
• The admin console also rendered a “Copy invite link” action from the same response field, so deployments using the web UI exposed the secret link there as well as through the REST API.

A fix was pushed into the master branch but not yet published.

org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services.

Affected versions of this package are vulnerable to Improper Validation of Consistency within Input due to improper validation of the email_verified claim in the OIDC authentication. An attacker can cause arbitrary email addresses to be marked as verified by configuring a malicious or compromised upstream identity provider and exploiting the lack of correlation between the id_token and the userinfo endpoint responses.

Note: This is only exploitable if the OIDC identity provider is configured with trustEmail set to true and the userinfo endpoint is enabled.

There is no fixed version for org.keycloak:keycloak-services.

org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services.

Affected versions of this package are vulnerable to Incorrect Authorization in the RoleContainerResource process when FGAP v2 is enabled. An attacker can access unauthorized group metadata by enumerating role-to-group mappings if they possess a delegated administrative role with specific view permissions.

Note: This is only exploitable if the attacker already has a delegated administrative role with view permissions for roles but not for all groups.

There is no fixed version for org.keycloak:keycloak-services.