CVE-2026-94001 in Keycloak
Summary
by MITRE • 09/19/2026
A flaw was found in the Admin REST API of Keycloak, an open-source identity and access management solution. The endpoint used for deleting user credentials does not correctly check for fine-grained reset-password permissions. This allows a delegated administrator, who should be restricted from resetting passwords, to delete a user's password credentials, resulting in the user being unable to log in.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/19/2026
The vulnerability identified within Keycloak represents a critical authorization flaw located specifically within its Admin REST API implementation. As an open-source identity and access management solution, Keycloak relies heavily on fine-grained role-based access control to manage permissions for delegated administrators who oversee specific realms or client scopes. The core technical issue stems from the endpoint responsible for deleting user credentials failing to perform adequate checks against these granular permission sets. While standard authentication mechanisms may verify that a request originates from an authorized administrator, the authorization logic governing this specific action does not strictly enforce the distinction between general administrative privileges and restricted operations such as password resets or credential deletion. This oversight allows any delegated administrator with access to user management functions to bypass intended restrictions designed to prevent them from altering critical security attributes of other users' accounts.
From a technical perspective, the flaw exploits the gap in permission validation during the execution of the delete credentials operation. In a properly secured system, actions that significantly impact account integrity or availability must be gated by specific permissions, such as MANAGE_PASSWORDS or similar fine-grained roles defined within Keycloak's authorization services. However, because this check is missing or incorrectly implemented, an attacker possessing delegated admin rights can invoke the API endpoint to remove password credentials associated with a target user account. This action effectively strips the user of their primary means of authentication without requiring knowledge of the current password or triggering additional verification steps that might alert security monitoring systems. The absence of these checks violates fundamental principles of least privilege and separation of duties, which are essential for maintaining secure administrative boundaries in multi-tenant identity environments.
The operational impact of this vulnerability is severe, primarily manifesting as a denial-of-service condition against targeted user accounts. By deleting the password credentials, the attacker renders the affected users unable to log into their systems, effectively locking them out until an administrator with higher-level privileges intervenes to restore access or reset the passwords manually. This disruption can halt business operations for individuals relying on these accounts and create significant administrative overhead as IT support teams must troubleshoot login failures that appear unrelated to network issues or service outages. Furthermore, this capability could be leveraged by malicious insiders who have been granted delegated admin rights but should not possess such destructive powers, potentially leading to data loss if the inability to access systems prevents users from saving work or accessing critical resources before their accounts are locked out.
In terms of industry standard classifications, this vulnerability aligns with CWE-269, which describes Improper Privilege Control, as it involves a user possessing insufficient privileges for an action that they were able to execute due to a logic error. It also relates closely to CWE-862, the Missing Authorization check, since the system failed to verify whether the actor had the specific permission required for credential deletion. From a threat modeling perspective using MITRE ATT&CK techniques, this behavior corresponds to T1098, specifically STIX patterns related to Account Manipulation or SSH Hijacking if applied in contexts where credentials are used for automated access, though more broadly it fits under unauthorized account modification that leads to availability compromise. The exploitation vector is typically remote via the REST API, allowing attackers who have obtained valid delegated admin credentials through phishing, credential stuffing, or other initial access methods to escalate their impact beyond intended boundaries without needing further privilege escalation exploits.
Mitigation strategies must focus on both immediate remediation and long-term architectural improvements. Organizations running vulnerable versions of Keycloak should immediately apply the vendor-provided security patch that corrects the permission checks within the Admin REST API endpoints. Until patches are applied, administrators can implement network-level controls to restrict access to sensitive administrative APIs or enforce stricter monitoring for unusual patterns in credential deletion requests. Long-term mitigation involves adopting a defense-in-depth approach where identity management systems undergo regular penetration testing focused on authorization logic rather than just authentication flaws. Additionally, organizations should review their delegated administration policies to ensure that the principle of least privilege is strictly enforced, minimizing the number of users who hold any form of administrative access and ensuring that those who do are restricted from performing high-impact actions like credential deletion unless absolutely necessary for operational requirements. Regular audits of admin activity logs can also help detect such unauthorized attempts earlier in their lifecycle.