CVE-2026-14614: Keycloak-services: keycloak-services: fgap v2 client scope assignment bypass via clientresource
A flaw was found in the ClientResource component of Keycloak's admin services when Fine-Grained Admin Permissions (FGAP) v2 is enabled. This issue allows a delegated administrator, who should only have limited control over specific clients, to attach or remove hidden client scopes that they are not authorized to see or manage. As a result, an attacker could inject unauthorized data or permissions into the security tokens issued to end-users, potentially tricking other applications into granting higher levels of access than intended.
Other sources
A write-path authorization bypass vulnerability exists in the ClientResource.addDefaultClientScope() and related endpoints in Keycloak when adminPermissionsEnabled is set to true (FGAP v2). The flaw stems from insufficient permission validation: the code only verifies that the caller has manage permissions on the target client but fails to check if the caller has any permissions (such as view or map) on the client scope being attached. An attacker with a delegated admin role (Clients:view and Clients:manage on at least one client) can exploit this by discovering the UUID of a "hidden" client scope (one they are otherwise restricted from accessing). By calling the client scope assignment endpoints, the attacker can successfully link these hidden scopes to their managed client. Concrete Impact: Unauthorized Claim Injection: Attacker can inject claims from restricted client scopes into end-user access tokens.
Authorization Bypass in Relying Apps: Applications relying on Keycloak token claims for internal authorization decisions may grant unauthorized access based on the injected claims.
Data Exposure: If the hidden scope contains sensitive hardcoded claims or mappers, these are exposed to the end-user and the relying application.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
In Keycloak admin services, disable Fine-Grained Admin Permissions (FGAP) v2 by setting adminPermissionsEnabled to false to prevent the write-path authorization bypass in ClientResource.addDefaultClientScope() and related endpoints.
Keycloak admin services (ClientResource; FGAP v2) adminPermissionsEnabled = false - Compensating control
Mitigate the impact by preventing delegated admins (who only have Clients:view and Clients:manage on selected clients) from being able to call client scope assignment endpoints that could attach hidden client scopes; restrict access to those endpoints to trusted admins only (e.g., via network/API access control or other external access restrictions).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-14614?
The severity of CVE-2026-14614 is rated as medium with a score of 5.4.
How do I fix CVE-2026-14614?
To fix CVE-2026-14614, ensure that Fine-Grained Admin Permissions (FGAP) v2 is correctly configured and review delegated administrations for potential unauthorized access.
What components are affected by CVE-2026-14614?
CVE-2026-14614 affects the Keycloak ClientResource component within the admin services.
Who is at risk from CVE-2026-14614?
Delegated administrators with limited control may bypass restrictions due to CVE-2026-14614, risking unauthorized access to hidden client scopes.
When was CVE-2026-14614 published?
CVE-2026-14614 was published on July 3, 2026.