A flaw was found in the Keycloak Admin REST API, which is used to manage security realms and clients. The issue occurs when the system processes requests for rotated client secrets that are stored in a secure vault. Due to improper boundary enforcement, a delegated administrator with view-only permissions can retrieve the actual resolved secret instead of the vault placeholder, leading to the exposure of sensitive credentials.

A flaw was found in the default-groups REST endpoint and realm representation of Keycloak. This component is responsible for managing groups that are automatically assigned to new users within a realm. The issue allows a delegated administrator with realm-viewing permissions to see the names and identifiers of hidden default groups, even if they lack the specific permissions to view those groups. This can lead to the exposure of sensitive organizational structures or internal group names.

A missing authorization check vulnerability was discovered in Keycloak admin REST API name-based composite endpoints. The flaw exists in the RoleContainerResource where the name-based path (/admin/realms/{realm}/roles/{role-name}/composites) was not updated with the security fixes previously applied to the id-based path. The root cause is the failure to validate that a delegated administrator has the necessary permissions to modify built-in admin roles when using the name-based resource path. An attacker with manage-realm permissions can exploit this by sending a DELETE request to the name-based composite endpoint. Successful exploitation allows an attacker to remove the manage-users, impersonation, or manage-clients child roles from the built-in admin role, thereby degrading the permissions of other administrators within the same realm.

A sensitive information disclosure flaw was found in the Keycloak Admin REST API. The vulnerability exists in the GET /admin/realms/{realm}/clients/{clientUuid}/client-secret/rotated endpoint. When a confidential client is configured to use a vault-backed rotated secret (e.g., using a placeholder like ${vault.rotated-secret}), the endpoint returns the resolved plaintext value from the vault instead of the placeholder string. This issue specifically affects the rotated secret and not the primary client secret. Exploitation requires the attacker to have high privileges, specifically the realm-management:view-clients role. A successful attack allows a delegated administrator to bypass vault security boundaries and obtain usable client credentials, which could be used to impersonate the affected client.

A flaw was found in the Keycloak Admin REST API when Fine-Grained Admin Permissions (FGAP) v2 is enabled. The default-groups endpoint and the general realm representation do not correctly enforce per-group view permission checks for default groups. A delegated administrator who has been granted realm-level view permissions but is explicitly denied view permissions for specific groups can still enumerate those hidden groups. By accessing the admin/realms/{realm}/default-groups or admin/realms/{realm} endpoints, the attacker can recover group names, UUIDs, and paths. This allows an authenticated attacker to map out the authorization topology, including onboarding structures, privilege levels, or tenant information that should remain restricted.