A flaw was found in Keycloak. An authenticated user with the uma_protection role can bypass User-Managed Access (UMA) policy validation. This allows the attacker to include resource identifiers owned by other users in a policy creation request, even if the URL path specifies an attacker-owned resource. Consequently, the attacker gains unauthorized permissions to victim-owned resources, enabling them to obtain a Requesting Party Token (RPT) and access sensitive information or perform unauthorized actions.
| Vendor | Product | Versions |
|---|---|---|
| red hat | keycloak | maven/org.keycloak:keycloak-services: < 26.5.7 |
Updated severity to CRITICAL, changed exploit availability to false, and provided a new description detailing the vulnerability.
Initial creation
