CVE-2026-94000 in Keycloak
Summary
by MITRE • 09/19/2026
A flaw was found in the Admin REST API of Keycloak, an open-source identity and access management solution. The issue occurs in the group-membership endpoints where the system fails to check if a group grants administrative privileges before allowing a user to be added. This allows a delegated administrator with limited permissions to add themselves to a high-privilege group, potentially gaining full control over the entire realm.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/19/2026
The vulnerability identified in Keycloak represents a critical authorization failure within its Admin REST API, specifically targeting the endpoints responsible for managing group memberships. As an open-source identity and access management solution widely deployed by enterprises to secure digital assets, Keycloak relies on strict role-based access control mechanisms to ensure that administrative actions are performed only by users with appropriate privileges. The flaw resides in the logic governing how new members are added to groups via the API. When a request is made to add a user to a group, the system fails to perform an adequate verification step to determine if the target group possesses elevated administrative permissions or realm-wide authority. This oversight creates a significant gap in the enforcement of least privilege principles, allowing actions that should be restricted to high-level administrators to be executed by users with delegated, limited access rights.
From a technical perspective, this issue is classified as an insecure direct object reference combined with broken access control, aligning closely with CWE-284 Improper Access Control and CWE-639 Authorization Bypass Through User-Controlled Key in the Common Weakness Enumeration framework. The core of the problem lies in the server-side validation logic which accepts the group identifier from the client request without sufficiently cross-referencing it against a whitelist or permission matrix that restricts such modifications to authorized administrators only. Consequently, an attacker who has obtained valid credentials for a delegated administrator account can exploit this endpoint by specifying the ID of a high-privilege group in their API call. Since the server does not verify whether the requesting user is permitted to modify members of that specific group, it processes the request and adds the attacker's account to the privileged group without raising an error or denying access.
The operational impact of this vulnerability is severe, as it effectively allows for privilege escalation from a low-privilege delegated administrator role to full realm administration. Once added to a high-privilege group, the compromised user inherits all permissions associated with that group, which typically include the ability to manage users, configure authentication flows, access sensitive data, and modify security policies across the entire Keycloak realm. This level of control enables an attacker to create additional backdoor accounts, exfiltrate identity data, or disrupt services by altering critical configuration settings. In environments where Keycloak serves as a central identity provider for multiple downstream applications, compromising the realm can lead to widespread unauthorized access and potential data breaches across all connected systems that trust this single source of truth for authentication and authorization decisions.
This exploitation path maps directly to several techniques in the MITRE ATT&CK framework, particularly T1078 Valid Accounts, where attackers use legitimate credentials to gain initial access, followed by T1098 Account Manipulation, specifically adding accounts to groups with elevated privileges. The ability to modify group memberships without proper authorization checks also relates to T1484 Domain Policy Modification if the attacker proceeds to alter domain-level security policies after gaining administrative control. Recognizing these patterns is crucial for defenders aiming to detect and mitigate such threats within their identity infrastructure, as it highlights how seemingly minor configuration flaws can be leveraged to achieve complete system compromise through legitimate API channels that are often less monitored than direct console access.
To mitigate this vulnerability, organizations must ensure they apply the latest security patches provided by Keycloak maintainers, which address the missing authorization checks in the group-membership endpoints. In addition to patching, administrators should implement strict network-level controls such as firewalls or API gateways that restrict access to Admin REST APIs exclusively from trusted internal networks and specific IP addresses known for administrative activity. Implementing multi-factor authentication for all administrative accounts adds a critical layer of defense against credential theft, which is often the precursor to this type of exploitation. Furthermore, adopting a principle of least privilege involves regularly auditing delegated administrator roles to ensure they are granted only the minimum permissions necessary for their operational tasks, thereby reducing the attack surface available to potential adversaries seeking to escalate privileges through group membership manipulation.