REDHAT-BUG-2537312: Medium severity Keycloak Keycloak vulnerability
A Missing Authorization vulnerability was discovered in Keycloaks Admin REST API. The flaw exists in the way the API resolves client resources using the per-request in-memory cache in the org.keycloak.models.cache.infinispan component. The cache is keyed by client UUID alone and does not perform a realm ownership validation when a resource is retrieved. An authenticated attacker with the create-realm role in the master realm can exploit this by creating a new realm and then addressing a master realm client using its UUID through the attacker-controlled realms API path. If the master realm client is present in the per-request cache, the system returns or updates the master client instead of enforcing realm boundaries. Successful exploitation allows an attacker to: Read client details, including credentials of confidential clients in the master realm.
Overwrite client configurations, such as injecting arbitrary redirect URIs into built-in master clients like admin-cli or security-admin-console.
Turn the master authorization endpoint into an open redirect.
Potentially affect other resource types that utilize the same per-request cache pattern.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be authenticated and have the create-realm role in the master realm. They can create a realm they control and use its API path to target a master-realm client by UUID.
What must occur for the cross-realm access to succeed?
The targeted master-realm client must be present in the per-request in-memory cache when it is requested through the attacker-controlled realm path. The vulnerable cache lookup uses the client UUID without validating that the client belongs to the requested realm.
What could an attacker do after successful exploitation?
They may read master-realm client details, including confidential-client credentials, or modify client configuration. Examples include adding arbitrary redirect URIs to built-in clients such as admin-cli or security-admin-console, potentially making the master authorization endpoint an open redirect.