REDHAT-BUG-2464126: Medium severity Red Hat Keycloak vulnerability
When Keycloak is started with --features-disabled=account,account-api, the Account REST API is only partially disabled. Five endpoints under the versioned path /account/v1alpha1 remain fully functional — including both read and write operations — because they lack the checkAccountApiEnabled() gate that correctly blocks four other endpoints in the same REST service class. The user needs to have permissions to use the API.
Affected Software
Event History
Frequently Asked Questions
What are the potential risks associated with REDHAT-BUG-2464126?
The risks include unauthorized access to sensitive user account information due to partially disabled API endpoints.
How do I fix REDHAT-BUG-2464126?
To fix REDHAT-BUG-2464126, ensure that Keycloak is configured correctly and that the account and account-api features are enabled when they are required.
What versions of Keycloak are affected by REDHAT-BUG-2464126?
The vulnerability affects all versions of Red Hat Keycloak that allow the features to be disabled.
Is there a workaround for REDHAT-BUG-2464126?
A potential workaround is to avoid starting Keycloak with the `--features-disabled=account,account-api` option.
What is the severity level of REDHAT-BUG-2464126?
The severity level of REDHAT-BUG-2464126 is considered high due to the exposure of critical endpoints.