CVE-2026-97177: Keycloak-services: keycloak-services: generic user update bypasses denied reset-password permission
A flaw was found in the user update mechanism of the Keycloak Admin REST API. When Fine-Grained Admin Permissions are enabled, the system fails to check for specific password reset authorizations during a general user profile update. This allows a delegated administrator, who should be restricted from resetting passwords, to change a user's credentials and take over their account.
Other sources
A Missing Authorization flaw was found in the org.keycloak.services.resources.admin package of Keycloak. The Admin REST API endpoint for updating user information (PUT /admin/realms/{realm}/users/{id}) enforces generic user management permissions (requireManage) but fails to validate fine-grained reset-password authorization (requireResetPassword). In environments where Fine-Grained Admin Permissions (FGAP) are enabled, a delegated administrator who has been granted manage permissions but is explicitly denied reset-password authority can include a credentials object in the user update payload. Because the specific permission check is missing in this code path, the password update is processed successfully. Successful exploitation allows a restricted administrator to: Set a new password for any managed user.
Gain full unauthorized access to victim accounts (account takeover).
Lock legitimate users out of their accounts.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
Which Keycloak deployments are exposed to this authorization bypass?
The issue applies in environments where Fine-Grained Admin Permissions are enabled and delegated administrators have generic user-management permissions while being denied reset-password authority.
What access does an attacker need to exploit the issue?
An attacker must already be a delegated administrator with permission to manage the targeted users. They can exploit the PUT /admin/realms/{realm}/users/{id} endpoint by including a credentials object in a general user update request.
What is the likely impact of successful exploitation?
A restricted administrator can set a new password for a managed user despite lacking reset-password permission. This can allow the administrator to take over that user's account.