Patch Ticker

Keycloak client manager can gain realm administrator authority

Red Hat login server lets limited users take full control.

Summary

A flaw in Keycloak's protocol mapper and identity handling lets an attacker with only limited client management permissions impersonate a realm administrator and take full control of the realm. Red Hat build of Keycloak 26.4 and 26.6 lines are affected.

Affected when

  • Attacker holds limited client management permissions
  • Service account tokens use hardcoded-claim mappers

What to do

Update the 26.4 line to 26.4.17 and the 26.6 line to 26.6.8.

Update to at least the version for your product:

  • Red Hat build of Keycloak 26.4 26.4.17 or later
  • Red Hat build of Keycloak 26.6 26.6.8 or later

Products and platforms

  • Red Hat build of Keycloak 26.4
  • Red Hat build of Keycloak 26.4.17
  • Red Hat build of Keycloak 26.6
  • Red Hat build of Keycloak 26.6.8
  • Red Hat Single Sign-On 7

CVE IDs

Sources

Times

First published

First seen