CVE-2026-9797 in Keycloak
Summary
by MITRE • 11/06/2026
A flaw was found in Keycloak's administrative services (org.keycloak.services.resources.admin). A highly privileged attacker, authenticated with a 'manage-clients' role, could exploit this vulnerability through several methods, including manipulating client JSON Web Key Sets (JWKS), swapping client authenticator types and resetting secrets, or downloading legitimate signing keys. Successful exploitation allows the attacker to obtain a token with 'realm-admin' role assignments, leading to privilege escalation and potential unauthorized access to sensitive resources.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 11/06/2026
The vulnerability identified in Keycloak's administrative services represents a critical security flaw within the org.keycloak.services.resources.admin package, which handles core administrative operations for identity and access management systems. This component is responsible for managing client configurations, authentication flows, and key distribution mechanisms that are fundamental to maintaining secure communication between clients and the authorization server. The existence of this vulnerability indicates a failure in input validation or state management logic within these high-privilege endpoints, allowing an attacker who has already gained authenticated access with specific administrative permissions to manipulate critical system states.
The primary technical flaw involves improper handling of client configuration data, specifically regarding JSON Web Key Sets (JWKS), authenticator types, and secret management. An attacker possessing the manage-clients role can exploit this by manipulating the JWKS associated with a client application. By altering these cryptographic keys or swapping them out, an adversary can effectively control the signing verification process for tokens issued to that client. Additionally, the vulnerability allows for the alteration of client authenticator types and the resetting of secrets without sufficient authorization checks or audit trails. This capability enables the attacker to download legitimate signing keys from the server, which are typically used to sign JSON Web Tokens (JWTs) that assert user identity and privileges.
The operational impact of this flaw is severe due to its direct link to privilege escalation. By obtaining control over the client's signing key or manipulating the authentication flow, an attacker can forge tokens that contain elevated role assignments, specifically granting themselves realm-admin permissions. This effectively bypasses the intended access control boundaries, allowing unauthorized users to assume administrative privileges within the Keycloak realm. Once these high-level roles are acquired, the attacker gains unrestricted access to sensitive resources, including user data, client configurations, and other critical identity management functions. The ability to download legitimate signing keys further exacerbates this risk by enabling persistent forgery of valid tokens that appear authentic to downstream services relying on them for authentication decisions.
This vulnerability aligns with CWE-269, which describes Improper Privilege Management, as it allows a user with lower privileges to escalate their rights through manipulation of administrative functions. It also relates to CWE-345, Insufficient Verification of Data Authenticity, because the system fails to properly validate that changes to critical security parameters like signing keys are authorized and consistent with expected state transitions. From an ATT&CK perspective, this exploitation technique falls under T1078, Valid Accounts, as it relies on existing authenticated credentials, and potentially T1528, Steal Application Access Token, if the forged tokens are used to access other services in a federated environment.
Mitigation strategies must focus on immediate remediation of the underlying code defects within the administrative service layer. Organizations should apply the latest security patches provided by Keycloak vendors that address these specific input validation and authorization checks. In environments where patching is not immediately feasible, network-level controls such as strict firewall rules limiting access to administrative endpoints can reduce exposure. Additionally, implementing robust monitoring for unusual changes in client configurations or key rotations can help detect exploitation attempts early. It is also critical to enforce the principle of least privilege by ensuring that manage-clients roles are granted only to trusted administrators and that multi-factor authentication is required for all administrative actions involving cryptographic keys or sensitive configuration changes.