CVE-2026-96448 in Keycloak
Summary
by MITRE • 09/25/2026
A flaw was found in the Fine-Grained Admin Permissions (FGAP v2) feature of Keycloak, an identity and access management solution. The issue occurs when the system checks if a delegated administrator has permission to assign a specific role to a user. Because the check does not look inside composite roles to see what other permissions they contain, an administrator with limited rights can assign a role that secretly includes full administrative control. This allows the attacker to gain complete management access over the entire realm.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/25/2026
The vulnerability identified in Keycloak’s Fine-Grained Admin Permissions version two represents a critical authorization bypass rooted in flawed logic during permission validation for composite roles. In identity and access management systems, fine-grained permissions are designed to adhere to the principle of least privilege by allowing administrators to delegate specific subsets of administrative rights without granting full control. However, this flaw arises because the system fails to recursively inspect the contents of composite roles when determining if a delegated administrator has sufficient authority to assign them. A composite role is essentially a container that aggregates multiple other roles or permissions into a single entity for easier management and assignment. When an administrator attempts to assign such a composite role to another user, Keycloak checks only against the top-level permission associated with that action rather than drilling down into the constituent parts of the composite role itself. This oversight means that if the composite role contains any administrative capability that exceeds the delegator’s own permissions, the system incorrectly validates the assignment as permissible.
This technical flaw enables a low-privilege delegated administrator to escalate their privileges significantly by assigning themselves or other users roles that effectively grant complete management access over an entire realm. For instance, a user with limited rights might be able to assign a composite role that includes administrative permissions they do not inherently possess because the validation logic does not account for the aggregated nature of those permissions. Once this assignment is successful, the recipient gains full control over the identity and access management configuration, including the ability to modify users, clients, policies, and other critical security settings within the realm. This constitutes a severe breach of confidentiality and integrity as it allows unauthorized entities to manipulate authentication mechanisms, potentially leading to further exploitation such as session hijacking or data exfiltration through compromised client configurations.
From an industry standards perspective, this vulnerability aligns with CWE-269, which describes Improper Privilege Management, specifically where the system fails to enforce appropriate restrictions on privileged functions based on user roles. Furthermore, it maps directly to MITRE ATT&CK technique T1078, Valid Accounts, as well as sub-techniques related to privilege escalation within cloud environments or identity providers like IAM Access Control Bypass (T1498). The core issue lies in the failure of the access control mechanism to properly evaluate complex role hierarchies, leading to an authorization bypass that undermines the foundational security model of the application. Such flaws are particularly dangerous because they often go undetected by standard penetration testing methodologies that focus on direct permission checks rather than recursive composite evaluations.
Mitigation strategies must address both immediate remediation and long-term architectural improvements. The primary solution is for organizations to upgrade Keycloak to a version where this specific validation logic has been corrected to recursively inspect all components of composite roles before granting assignment permissions. Until an update can be applied, administrators should strictly audit existing role assignments and remove any delegated privileges that involve the management of composite roles containing administrative capabilities. Additionally, implementing robust monitoring for unusual privilege escalation events within the identity provider’s logs can help detect potential exploitation attempts in real time. Security teams should also review their delegation policies to ensure that no single user holds excessive authority over role definitions, thereby reducing the blast radius if such a vulnerability is exploited in other contexts or future versions of similar software.