CVE-2026-94001: Keycloak-services: keycloak-services: admin credential delete bypasses denied reset-password permission
A flaw was found in the Admin REST API of Keycloak, an open-source identity and access management solution. The endpoint used for deleting user credentials does not correctly check for fine-grained reset-password permissions. This allows a delegated administrator, who should be restricted from resetting passwords, to delete a user's password credentials, resulting in the user being unable to log in.
Other sources
A Missing Authorization flaw was found in the Keycloak Admin REST API. The endpoint for deleting user credentials (DELETE /admin/realms/{realm}/users/{id}/credentials/{credentialId}) only verifies generic user management permissions (requireManage) and fails to enforce fine-grained reset-password authorization (requireResetPassword). This issue affects deployments where Fine-Grained Admin Permissions (FGAP) are enabled. An attacker with delegated administrator privileges, who is granted manage permissions but explicitly denied reset-password authority via a negative policy, can bypass this restriction. By invoking the credential deletion endpoint, the attacker can successfully delete stored password credentials for managed users. The concrete impact includes: Deleting a user's primary authentication credentials.
Causing account lockout for the victim user.
Performing a targeted denial of service against managed users.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
If possible, disable Fine-Grained Admin Permissions (FGAP) because the missing authorization issue affects deployments where FGAP is enabled.
Keycloak Admin REST API (Fine-Grained Admin Permissions / FGAP) Fine-Grained Admin Permissions (FGAP) = disabled - Compensating control
Restrict access to Keycloak Admin REST API endpoints so delegated administrators who have manage permissions but are explicitly denied reset-password authority cannot invoke the user credential deletion endpoint DELETE /admin/realms/{realm}/users/{id}/credentials/{credentialId}.
Event History
Frequently Asked Questions
Which deployments are affected?
The issue affects Keycloak deployments where Fine-Grained Admin Permissions (FGAP) are enabled and delegated administrators have generic user management permission while being explicitly denied reset-password authority through a negative policy.
What access does an attacker need?
An attacker needs delegated administrator privileges with manage permissions over the targeted users. They can exploit the issue through the Admin REST API credential-deletion endpoint; no user interaction is required.
What is the practical impact of exploitation?
The attacker can delete stored password credentials for users they manage, including a user's primary password credential. This can prevent affected users from logging in.