CVE-2026-4630: Keycloak: keycloak: unauthorized resource access and data modification via insecure direct object reference
A flaw was found in Keycloak. An authenticated client could exploit an Insecure Direct Object Reference (IDOR) vulnerability in the Authorization Services Protection API endpoint. By knowing or obtaining a resource's unique identifier (UUID) belonging to another Resource Server within the same realm, the client could bypass authorization checks. This allows the client to perform unauthorized GET, PUT, and DELETE operations on resources, leading to information disclosure and potential unauthorized modification or deletion of data.
Other sources
Summary:
IDOR vulnerability in the Keycloak Authorization Services Protection API endpoint /realms/{realm}/authz/protection/resourceset/{id} allows authenticated clients to perform GET, PUT, and DELETE operations on resources belonging to other Resource Servers within the same realm. The endpoint fails to validate that the requested resource UUID belongs to the calling Resource Server.
Requirements to exploit:
Attacker must possess valid client credentials for any Resource Server with Authorization Services enabled in the target realm, and must know or obtain the UUID of a resource belonging to another Resource Server.
Steps to reproduce:
1. Configure a Keycloak realm with two clients (clientA, clientB) with Authorization Services enabled and allowRemoteResourceManagement=true 2. Create a resource under clientB and note its UUID 3. Obtain a clientcredentials token for clientA using its client secret 4. Using clientA's token, send GET /realms/{realm}/authz/protection/resourceset/{clientB-resource-uuid} — returns 200 with clientB's resource data 5. Send PUT to the same endpoint with modified payload — returns 204, resource is modified 6. Send DELETE to the same endpoint — note: triagers reported this fails with an authorization error in 26.5.4, but GET and PUT succeed 7. Confirm modification by querying with clientB's token
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-4630?
CVE-2026-4630 is considered a moderate severity vulnerability due to potential unauthorized access and data modification.
How do I fix CVE-2026-4630?
To fix CVE-2026-4630, ensure that proper access controls and validation mechanisms are implemented in the Authorization Services Protection API.
Who is affected by CVE-2026-4630?
CVE-2026-4630 affects authenticated clients utilizing the Keycloak platform that access the Authorization Services Protection API endpoint.
What type of vulnerability is CVE-2026-4630?
CVE-2026-4630 is an Insecure Direct Object Reference (IDOR) vulnerability allowing unauthorized resource access.
Can CVE-2026-4630 lead to data theft?
Yes, exploitation of CVE-2026-4630 can potentially lead to unauthorized data modification and access, posing a risk for data theft.