Keycloak Authorization and Auth Flaws

Mandatory required-action challenges in Keycloak - as shipped in Red Hat Build of Keycloak and Red Hat Single Sign-On 7 - can be skipped when an authorization request carries a kc_action query parameter set to a required action that is already pending on the account, such as profile verification (VERIFY_PROFILE) or terms-and-conditions acceptance. The attacker must be an authenticated user (CVSS PR:L) whose administrator has already assigned that mandatory action; the broken application-initiated-action handling then lets the authorization code be issued without the challenge being completed, so the user reaches the application while bypassing onboarding and compliance gates. The exposure is confined to defeating that mandatory-action control (integrity impact only, per the assessed vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N, 5.4 medium) and does not escalate the user beyond their own granted access; no public exploit code or CISA KEV confirmation was identified at time of analysis.

Authenticated users who already hold resource-management permissions can update UMA resources they do not own in Keycloak's authorization services when remote resource management is enabled, letting them alter other users' resource names, URIs and scopes. The flaw is an IDOR-style authorization bypass (CWE-639) rated CVSS 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N), so integrity impact is limited and no confidentiality or availability impact is assessed. There is no public exploit identified at time of analysis, no confirmed active exploitation (CISA KEV), and the issue is only reachable when the non-default remote resource management feature is turned on and the attacker is an authenticated user with the relevant permissions.