EUVD-2026-40300
GHSA-m4j4-8chj-8g5f
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
Scope changed to S:C because privilege escalation to realm-admin crosses the manage-clients authorization boundary, affecting all realm components beyond the attacker's granted scope.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
Lifecycle Timeline
1DescriptionCVE.org
A flaw was found in Keycloak. A highly privileged user with manage-clients permission can exploit this vulnerability by injecting a hardcoded role mapper into any client. This action allows the user to bypass existing scope restrictions and inject the realm-admin role into generated tokens, resulting in privilege escalation and full administrative access to the realm.
AnalysisAI
Privilege escalation in Red Hat Build of Keycloak allows an operator holding the manage-clients permission to inject a hardcoded role mapper into any client configuration, causing the realm-admin role to appear in subsequently issued tokens. This effectively grants the attacker full administrative control over the entire Keycloak realm, overriding scope restrictions that are intended to prevent exactly this delegation boundary crossing. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an attacker to hold the manage-clients permission within the target Keycloak realm - this is a non-default, explicitly assigned delegated administrative role, confirmed by the CVSS PR:H metric. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The NVD CVSS 3.1 score of 6.5 reflects the PR:H prerequisite that meaningfully constrains exploitation to users who have already been explicitly granted manage-clients. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A Keycloak operator with manage-clients permission - such as a developer or tenant administrator in a multi-tenant deployment - accesses the admin console or REST API and injects a hardcoded role mapper targeting the realm-admin role into a client they control. When any user subsequently authenticates through that client, the issued JWT contains the realm-admin role claim, and the attacker (or a user they control) can present this token to Keycloak admin APIs to gain full control over the realm, including the ability to create accounts, modify other clients, and access all protected resources. … |
| Remediation | No vendor-released patch version has been independently confirmed from the available data. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Red Hat Build Of Keycloak
View allAuthorization bypass in the Keycloak Policy Enforcer allows any authenticated user to circumvent all enforced access con
Signature-verification bypass in Keycloak (and Red Hat's Keycloak-based products such as Red Hat Single Sign-On 7 and Re
Open redirect in Red Hat build of Keycloak permits remote attackers to send victims to attacker-controlled hosts by abus
Identity linking bypass in Red Hat build of Keycloak allows an attacker controlling a second account on the same upstrea
Authenticated users with uma_protection role in Red Hat Keycloak can bypass User-Managed Access policy validation to gai
Privilege escalation in Keycloak (Red Hat Build of Keycloak) lets an authenticated delegated admin with management right
Denial of service in Red Hat build of Keycloak allows remote unauthenticated attackers to exhaust CPU and worker threads
Denial of Service in Red Hat Build of Keycloak allows unauthenticated remote attackers to exhaust server resources by su
Session fixation in Keycloak's login-actions endpoints allows remote attackers to hijack authenticated sessions and take
Authorization code forgery in Red Hat Keycloak enables unauthenticated attackers to escalate privileges to admin-level a
Stored Cross-Site Scripting in Red Hat Build of Keycloak lets an authenticated administrator with `manage-client` permis
Open redirect in Red Hat Build of Keycloak allows authenticated attackers with control over another path on the same web
Same weakness CWE-266 – Incorrect Privilege Assignment
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today