EUVD-2026-39472
GHSA-rmcj-82cr-27rx
Severity by source
AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N
Network-reachable Admin REST API (AV:N) but needs existing delegated group-admin rights and FGAPv2 (PR:H, AC:H); cross-authority realm takeover yields S:C with full C/I/A impact.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
Lifecycle Timeline
1DescriptionCVE.org
A flaw was found in Keycloak. A missing authorization check in the GroupResource.addChild() endpoint within the Admin REST API allows an authenticated user with limited administrative privileges to reparent any existing group. When Fine-Grained Admin Permissions v2 (FGAPv2) is enabled, an attacker with management rights over a single low-privilege group can reparent a highly privileged group (such as one possessing the realm-admin role) under their managed group.
Because group permissions follow a hierarchical structure, this action unauthorizedly grants the attacker management and password-reset capabilities over the members of the targeted privileged group. An attacker can exploit this to reset an administrator's password, compromise the account, and achieve a full realm takeover, leading to a complete compromise of confidentiality, integrity, and availability.
AnalysisAI
Privilege escalation in Keycloak (Red Hat Build of Keycloak) lets an authenticated delegated admin with management rights over a single low-privilege group hijack the entire realm. A missing authorization check in the Admin REST API's GroupResource.addChild() endpoint allows reparenting an arbitrary group; when Fine-Grained Admin Permissions v2 (FGAPv2) is enabled, an attacker can move a privileged group (e.g., one holding realm-admin) under a group they control, inheriting management and password-reset rights over its members. There is no public exploit identified at time of analysis and the issue is not in CISA KEV, but the resulting full realm takeover makes it a serious escalation primitive in environments that delegate group administration.
Technical ContextAI
Keycloak is a widely used open-source identity and access management server (the upstream of Red Hat Build of Keycloak / RHSSO) providing OIDC and SAML SSO, federation, and fine-grained admin delegation. The flaw lives in the Admin REST API GroupResource.addChild() operation, which reparents groups within Keycloak's hierarchical group tree. Keycloak's Fine-Grained Admin Permissions v2 (FGAPv2) model derives a delegated admin's authority partly from group hierarchy, so management permissions granted on a parent group cascade to its child groups and their members. The root cause is CWE-639 (Authorization Bypass Through User-Controlled Key / IDOR-style missing object-level check): addChild() validates the caller's rights over the destination relationship but fails to verify the caller is authorized over the group actually being moved, letting a low-privileged group manager graft a high-privileged group beneath their own.
RemediationAI
No vendor-released patch version was identified at time of analysis from the provided data; consult the Red Hat advisory (https://access.redhat.com/security/cve/CVE-2026-9099) and Bugzilla 2480182 (https://bugzilla.redhat.com/show_bug.cgi?id=2480182) for the fixed build and apply it as the primary remediation once published. As a targeted compensating control until patched, disable Fine-Grained Admin Permissions v2 (FGAPv2) where it is not strictly required, since the escalation path only exists when FGAPv2 is enabled (trade-off: loss of granular delegated administration, possibly forcing a fallback to coarser admin roles). Where FGAPv2 must stay enabled, minimize the number of accounts granted group-management (manage) rights, avoid placing highly privileged groups such as those holding realm-admin where delegated admins can target them, and audit the admin event log for unexpected group reparent (addChild) operations. Restricting and monitoring Admin REST API access and reviewing delegated group permissions reduces exposure but does not fully close the flaw without the vendor fix.
More in Red Hat Build Of Keycloak
View allAccount takeover in Red Hat Build of Keycloak allows an unauthenticated attacker to abuse the reset-credentials flow in
Account takeover in Keycloak (Red Hat build of Keycloak, Red Hat Single Sign-On 7) arises because the IdP-initiated SAML
Authentication bypass in Red Hat Build of Keycloak (and Red Hat Single Sign-On 7) lets an unauthenticated attacker forge
Privilege escalation in Red Hat Build of Keycloak's Dynamic Client Registration (DCR) grants an attacker with low-privil
Authorization bypass in the Keycloak Policy Enforcer allows any authenticated user to circumvent all enforced access con
URI normalization bypass in Keycloak's Authorization Services PathMatcher allows authenticated low-privilege users to re
Privilege escalation in Keycloak's Dynamic Client Registration (DCR) component allows attackers with standard user accou
Token exchange in Keycloak bypasses Google Workspace domain allowlist restrictions, enabling any valid Google account ho
Signature-verification bypass in Keycloak (and Red Hat's Keycloak-based products such as Red Hat Single Sign-On 7 and Re
Tenant-restriction bypass in Keycloak's Microsoft identity provider integration allows attackers holding any valid Micro
Session hijacking via SAML assertion replay in Keycloak's SAML broker component allows adjacent-network attackers to aut
Open redirect in Red Hat build of Keycloak permits remote attackers to send victims to attacker-controlled hosts by abus
Same technique Authentication Bypass
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today