CVE-2026-94217: Keycloak-services: keycloak-services: uma scope merge across resource owners via resource name collision
A flaw was found in the Keycloak authorization token endpoint. The vulnerability is a logic error in how UMA permission tickets are processed when multiple resources share the same name across different owners. When a requester submits a permission ticket, the endpoint performs a lookup based on the resource name and the requester identity. However, it fails to properly isolate resources by their specific owner, leading to a scope merge where permissions from all matching resource names are aggregated into a single Requesting Party Token (RPT). An authenticated attacker with low privileges can exploit this by creating a resource with the same name as a victim's resource and sharing it with themselves. This triggers the merge mechanism, allowing the attacker to obtain an RPT containing scopes belonging to the victim's resource. This bypasses the standard policy engine evaluation for the victim's resource. Successful exploitation requires that the victim has previously shared their resource.
Other sources
A flaw was found in the User-Managed Access (UMA) implementation of Keycloak. The issue occurs in the authorization token endpoint when processing permission tickets. If two different users own resources with the same name, the system incorrectly merges the permissions from both resources when one user requests an authorization token. This allows an attacker to gain access scopes on a victim's resource that were never intended to be shared.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What conditions are required for exploitation?
The attacker must be authenticated with low privileges, create a resource using the same name as a victim-owned resource, and share the attacker-created resource with themselves. Exploitation also requires that the victim previously shared their resource.
Which deployments are exposed?
Deployments using the Keycloak User-Managed Access implementation and its authorization token endpoint for UMA permission-ticket processing are affected when resources with the same name exist across different owners.
What can an attacker gain if exploitation succeeds?
The attacker can obtain a Requesting Party Token containing scopes from the victim's resource. This bypasses the normal policy-engine evaluation for that victim resource.