EUVD-2026-16307
GHSA-7xf9-4jfc-wgm4
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
Primary rating from NVD.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
Lifecycle Timeline
4Blast Radius
ecosystem impact- 44 maven packages depend on org.keycloak:keycloak-services (16 direct, 28 indirect)
Ecosystem-wide dependent count for version 26.5.6.
DescriptionCVE.org
A flaw was found in Keycloak. An administrator with manage-clients permission can exploit a misconfiguration where this permission is equivalent to manage-permissions. This allows the administrator to escalate privileges and gain control over roles, users, or other administrative functions within the realm. This privilege escalation can occur when admin permissions are enabled at the realm level.
AnalysisAI
Keycloak allows authenticated administrators with manage-clients permission to escalate privileges to manage-permissions level, enabling unauthorized control over roles, users, and administrative functions within a realm. Red Hat Build of Keycloak, JBoss Enterprise Application Platform 8, and Red Hat Single Sign-On 7 are affected when admin permissions are enabled at the realm level. The vulnerability requires high-privilege authentication but carries medium CVSS severity (6.5) due to confidentiality and integrity impact without availability compromise.
Technical ContextAI
This privilege escalation vulnerability (CWE-266: Improper Privilege Management) exists in Keycloak's authorization and permission model at the realm administration level. The vulnerability stems from a misconfiguration or design flaw where the manage-clients permission-intended to allow administrators to create, modify, and delete OAuth2/OIDC clients-is incorrectly treated as equivalent to manage-permissions, which should grant authorization to modify access control policies and role assignments. The affected products include Red Hat Build of Keycloak (all versions per CPE cpe:2.3:a:red_hat:red_hat_build_of_keycloak), Red Hat JBoss Enterprise Application Platform 8 (CPE cpe:2.3:a:red_hat:red_hat_jboss_enterprise_application_platform_8), Red Hat JBoss Enterprise Application Platform Expansion Pack (CPE cpe:2.3:a:red_hat:red_hat_jboss_enterprise_application_platform_expansion_pack), and Red Hat Single Sign-On 7 (CPE cpe:2.3:a:red_hat:red_hat_single_sign-on_7). The flaw manifests when realm-level admin permissions are explicitly enabled, creating an unintended privilege equivalence.
RemediationAI
Upgrade Keycloak and dependent components (Red Hat Build of Keycloak, JBoss EAP 8, and Red Hat Single Sign-On 7) to patched versions as specified in the Red Hat security advisory at https://access.redhat.com/security/cve/CVE-2026-3121. For intermediate mitigation, restrict the assignment of manage-clients permission to only administrators who require it, enforce role-based access control (RBAC) to limit realm-level admin role grants, and implement audit logging for all permission changes and administrative role assignments to detect unauthorized privilege escalation attempts. Review all current administrator accounts and audit existing manage-clients permission grants against least-privilege principles.
More in Red Hat Build Of Keycloak
View allAccount takeover in Keycloak (Red Hat build of Keycloak, Red Hat Single Sign-On 7) arises because the IdP-initiated SAML
Account takeover in Red Hat Build of Keycloak allows an unauthenticated attacker to abuse the reset-credentials flow in
Authentication bypass in Red Hat Build of Keycloak (and Red Hat Single Sign-On 7) lets an unauthenticated attacker forge
Privilege escalation in Red Hat Build of Keycloak's Dynamic Client Registration (DCR) grants an attacker with low-privil
Authorization bypass in the Keycloak Policy Enforcer allows any authenticated user to circumvent all enforced access con
URI normalization bypass in Keycloak's Authorization Services PathMatcher allows authenticated low-privilege users to re
Privilege escalation in Keycloak's Dynamic Client Registration (DCR) component allows attackers with standard user accou
Token exchange in Keycloak bypasses Google Workspace domain allowlist restrictions, enabling any valid Google account ho
Signature-verification bypass in Keycloak (and Red Hat's Keycloak-based products such as Red Hat Single Sign-On 7 and Re
Tenant-restriction bypass in Keycloak's Microsoft identity provider integration allows attackers holding any valid Micro
Session hijacking via SAML assertion replay in Keycloak's SAML broker component allows adjacent-network attackers to aut
Open redirect in Red Hat build of Keycloak permits remote attackers to send victims to attacker-controlled hosts by abus
Same weakness CWE-266 – Incorrect Privilege Assignment
View allSame technique Privilege Escalation
View allVendor StatusVendor
Debian
Bug #1088287| Release | Status | Fixed Version | Urgency |
|---|---|---|---|
| open | - | - |
Share
External POC / Exploit Code
Leaving vuln.today