EUVD-2026-16309
GHSA-q35r-vvhv-vx5h
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Primary rating from NVD.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Lifecycle Timeline
4Blast Radius
ecosystem impact- 26 maven packages depend on org.keycloak:keycloak-model-jpa (3 direct, 23 indirect)
- 54 maven packages depend on org.keycloak:keycloak-server-spi-private (22 direct, 32 indirect)
- 44 maven packages depend on org.keycloak:keycloak-services (16 direct, 28 indirect)
Ecosystem-wide dependent count for version 26.5.6 and other introduced versions.
DescriptionCVE.org
A flaw was found in Keycloak. The User-Managed Access (UMA) 2.0 Protection API endpoint for permission tickets fails to enforce the uma_protection role check. This allows any authenticated user with a token issued for a resource server client, even without the uma_protection role, to enumerate all permission tickets in the system. This vulnerability partial leads to information disclosure.
AnalysisAI
Keycloak's User-Managed Access (UMA) 2.0 Protection API fails to enforce role-based access control on the permission tickets endpoint, allowing any authenticated user with a resource server client token to enumerate all permission tickets regardless of authorization level. This information disclosure vulnerability affects Red Hat Build of Keycloak across multiple versions and requires valid authentication to exploit, posing a moderate risk to multi-tenant environments where ticket enumeration could expose sensitive access control data. No public exploit code has been identified at time of analysis.
Technical ContextAI
The vulnerability exists in Keycloak's UMA 2.0 specification implementation, which defines a permission ticket endpoint used for resource servers to request access decisions. The flaw involves improper enforcement of the uma_protection role, a fine-grained access control mechanism designed to restrict sensitive operations. The root cause maps to CWE-280 (Improper Handling of Insufficient Permissions or Privileges), where the authorization check for role membership is either missing or bypassable. The affected product is identified via CPE as Red Hat Build of Keycloak (cpe:2.3:a:red_hat:red_hat_build_of_keycloak), suggesting the vulnerability affects Keycloak distributions maintained by Red Hat. The UMA 2.0 Protection API is a standardized OAuth 2.0 extension for delegated access management, making this a protocol-level enforcement failure rather than a logic error in a single code path.
RemediationAI
Consult Red Hat's security advisory at https://access.redhat.com/security/cve/CVE-2026-3190 and apply the vendor-released patch or upgrade to a patched version of Red Hat Build of Keycloak as specified in the advisory. For Debian users, check the status of the fix in Debian bug #1088287 and upgrade Keycloak packages when the patch is available in your distribution. Until patching is possible, implement compensating controls by restricting network access to the UMA 2.0 Protection API endpoint to known, trusted resource server clients using a reverse proxy or API gateway, and audit access logs for unauthorized enumeration attempts. Additionally, review and limit the scope of client tokens issued to resource servers to minimize the risk of token compromise and subsequent ticket enumeration.
More in Red Hat Build Of Keycloak
View allAccount takeover in Keycloak (Red Hat build of Keycloak, Red Hat Single Sign-On 7) arises because the IdP-initiated SAML
Account takeover in Red Hat Build of Keycloak allows an unauthenticated attacker to abuse the reset-credentials flow in
Authentication bypass in Red Hat Build of Keycloak (and Red Hat Single Sign-On 7) lets an unauthenticated attacker forge
Privilege escalation in Red Hat Build of Keycloak's Dynamic Client Registration (DCR) grants an attacker with low-privil
Authorization bypass in the Keycloak Policy Enforcer allows any authenticated user to circumvent all enforced access con
URI normalization bypass in Keycloak's Authorization Services PathMatcher allows authenticated low-privilege users to re
Privilege escalation in Keycloak's Dynamic Client Registration (DCR) component allows attackers with standard user accou
Token exchange in Keycloak bypasses Google Workspace domain allowlist restrictions, enabling any valid Google account ho
Signature-verification bypass in Keycloak (and Red Hat's Keycloak-based products such as Red Hat Single Sign-On 7 and Re
Tenant-restriction bypass in Keycloak's Microsoft identity provider integration allows attackers holding any valid Micro
Session hijacking via SAML assertion replay in Keycloak's SAML broker component allows adjacent-network attackers to aut
Open redirect in Red Hat build of Keycloak permits remote attackers to send victims to attacker-controlled hosts by abus
Same technique Information Disclosure
View allVendor StatusVendor
Debian
Bug #1088287| Release | Status | Fixed Version | Urgency |
|---|---|---|---|
| open | - | - |
Share
External POC / Exploit Code
Leaving vuln.today