REDHAT-BUG-2537313: Medium severity Keycloak Keycloak authorization token endpoint vulnerability
A flaw was found in the Keycloak authorization token endpoint. The vulnerability is a logic error in how UMA permission tickets are processed when multiple resources share the same name across different owners. When a requester submits a permission ticket, the endpoint performs a lookup based on the resource name and the requester identity. However, it fails to properly isolate resources by their specific owner, leading to a scope merge where permissions from all matching resource names are aggregated into a single Requesting Party Token (RPT). An authenticated attacker with low privileges can exploit this by creating a resource with the same name as a victim's resource and sharing it with themselves. This triggers the merge mechanism, allowing the attacker to obtain an RPT containing scopes belonging to the victim's resource. This bypasses the standard policy engine evaluation for the victim's resource. Successful exploitation requires that the victim has previously shared their resource.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Keycloak deployments using the authorization token endpoint are exposed when a victim has previously shared a resource. The issue requires multiple resources with the same name under different owners.
What does an attacker need to exploit it?
The attacker must be authenticated, even with low privileges. They need to create a resource using the same name as the victim's resource, share that resource with themselves, and submit a permission ticket.
Does exploitation require the victim resource to be publicly accessible?
No. The stated prerequisite is that the victim previously shared the resource; the flaw can then cause scopes from that resource to be included in the attacker's Requesting Party Token.
What is the security impact of a successful exploit?
The attacker can receive an RPT containing scopes belonging to the victim's resource. This bypasses normal policy-engine evaluation for the victim resource.