REDHAT-BUG-2537169: Medium severity Keycloak Keycloak vulnerability
A Missing Authorization flaw was found in the Keycloak Admin REST API. The endpoint for deleting user credentials (DELETE /admin/realms/{realm}/users/{id}/credentials/{credentialId}) only verifies generic user management permissions (requireManage) and fails to enforce fine-grained reset-password authorization (requireResetPassword). This issue affects deployments where Fine-Grained Admin Permissions (FGAP) are enabled. An attacker with delegated administrator privileges, who is granted manage permissions but explicitly denied reset-password authority via a negative policy, can bypass this restriction. By invoking the credential deletion endpoint, the attacker can successfully delete stored password credentials for managed users. The concrete impact includes: Deleting a user's primary authentication credentials.
Causing account lockout for the victim user.
Performing a targeted denial of service against managed users.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
The issue affects Keycloak deployments with Fine-Grained Admin Permissions enabled. It requires a delegated administrator who has user management permissions for managed users.
What permissions does an attacker need to exploit it?
The attacker needs delegated administrator privileges with manage permissions, while being explicitly denied reset-password authority through a negative policy. They can then call the credential-deletion endpoint to bypass that reset-password restriction.
What is the practical impact of successful exploitation?
An attacker can delete stored password credentials for users they manage. This can remove a victim's primary authentication credential and lock the account, creating a targeted denial of service.