CVE-2026-94217 in Keycloak
Summary
by MITRE • 09/21/2026
A flaw was found in the User-Managed Access (UMA) implementation of Keycloak. The issue occurs in the authorization token endpoint when processing permission tickets. If two different users own resources with the same name, the system incorrectly merges the permissions from both resources when one user requests an authorization token. This allows an attacker to gain access scopes on a victim's resource that were never intended to be shared.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/21/2026
The vulnerability identified in Keycloak’s User-Managed Access implementation represents a critical logic flaw within the authorization server component, specifically affecting the processing of permission tickets at the authorization token endpoint. This issue stems from an insufficient isolation mechanism when resolving resource identifiers during the access control evaluation process. In standard OAuth 2.0 and OpenID Connect architectures, particularly those utilizing UMA for fine-grained decentralized authorization, resources are typically identified by unique UUIDs or distinct namespaces to ensure that permissions granted for one entity do not inadvertently apply to another. However, in this flawed implementation, the system relies on resource names as a primary key for merging permission scopes rather than enforcing strict identity separation based on resource ownership and unique identifiers. This architectural oversight creates a scenario where the internal state management fails to distinguish between distinct resources that happen to share identical naming conventions across different user accounts.
The technical root cause lies in how the authorization server aggregates permissions when constructing an access token for a requesting client or user. When a permission ticket is presented, the system queries the database of owned resources and associated policies. If two separate users have created resources with the same name string, the lookup mechanism incorrectly treats these as references to a single resource entity rather than distinct objects belonging to different principals. Consequently, when User A requests an authorization token for their own resource named Report.pdf, the backend logic inadvertently includes permission scopes defined by User B’s similarly named Resource Report.pdf in the resulting token payload. This merging of permissions occurs without explicit consent from either party and bypasses the intended access control boundaries established during policy configuration.
The operational impact of this vulnerability is severe, as it allows for unauthorized privilege escalation through scope manipulation. An attacker who controls a resource with a specific name can exploit this logic error to gain access rights associated with another user’s resources that share that same name. For instance, if an attacker creates a public document named Confidential_Data and the victim has a private database export also named Confidential_Data, the attacker might receive tokens containing scopes intended only for the victim’s sensitive data. This leads directly to unauthorized data exposure, where confidential information becomes accessible to entities that should have no visibility into it. Furthermore, this flaw undermines the fundamental trust model of UMA, which relies on explicit resource owner consent for every granular permission grant. The erosion of these boundaries can facilitate broader attacks such as horizontal privilege escalation within multi-tenant environments or lateral movement if combined with other vulnerabilities in dependent applications relying on Keycloak tokens.
From a classification perspective, this vulnerability aligns closely with CWE-284 Improper Access Control and CWE-601 URL Redirection to Untrusted Site via Suffix Confusion, although the latter is more applicable to redirect logic; here it is better described as CWE-937 Use of OWASP Top 10 Vulnerable Components or specifically a Logic Flaw in access control decisions. In terms of MITRE ATT&CK mapping, this behavior facilitates Initial Access and Privilege Escalation techniques by allowing an adversary to leverage misconfigured trust relationships between resources. The attack vector is typically remote and requires the attacker to have at least basic authentication capabilities within the Keycloak realm to create their own resource entries with matching names.
Mitigation strategies must focus on enforcing strict uniqueness constraints or explicit identifier-based resolution in the permission ticket processing logic. Administrators should immediately verify if any shared resources exist across different user accounts that could be exploited, renaming them to ensure global uniqueness of resource identifiers within the tenant context. While a permanent patch is required from the vendor to correct the underlying code logic by ensuring permissions are resolved via unique UUIDs rather than name strings, immediate workarounds include implementing strict naming policies for all resources and reviewing access control lists to identify any unintended scope overlaps. Additionally, enabling detailed audit logging on the authorization token endpoint can help detect anomalous patterns where tokens contain unexpected permission scopes, allowing for rapid incident response before widespread exploitation occurs.