Keycloak Authorization Bypass via Mandatory Action Bypass

Executive Summary

This vulnerability affects Keycloak, an identity and access management system. It involves incorrect handling of the kc_action query parameter when set to a mandatory action like profile verification or terms acceptance. Keycloak skips these mandatory challenges and issues an authorization code, allowing users to bypass required administrative steps.

Useful 0 Not Useful 0

Detection Guidance

Monitor Keycloak logs for authorization requests containing the kc_action query parameter set to mandatory actions like VERIFY_PROFILE or TERMS_AND_CONDITIONS. Check for successful authentication flows that skip these required challenges despite pending actions.

Useful 0 Not Useful 0

Impact Analysis

An authenticated attacker with a pending required action could exploit this to bypass mandatory profile updates or terms acceptance. This allows them to gain unauthorized access to applications without completing necessary steps, potentially leading to improper authentication and session establishment.

Useful 0 Not Useful 0

Mitigation Strategies

Apply available patches or updates from Keycloak or Red Hat once released. Temporarily disable or restrict access to authorization endpoints until mitigation is applied. Monitor Red Hat advisories for official fixes or workarounds.

Useful 0 Not Useful 0