Hardcoded-Claim Mapper Privilege Escalation in Keycloak

Executive Summary

This vulnerability affects Keycloak's protocol mapper and identity resolution components. It occurs when a client manager uses hardcoded-claim mappers to override identity claims in sessionless service-account tokens. Since these tokens lack a session ID, Keycloak may incorrectly resolve the token bearer as a highly privileged user based on manipulated claims. This allows an attacker with limited client management permissions to impersonate a realm administrator and gain full control over the affected realm.

Useful 0 Not Useful 0

Impact Analysis

An attacker with manage-clients permissions can exploit this to impersonate a realm administrator, bypass role restrictions, and perform any administrative action via the Admin REST API. This includes enumerating, creating, or deleting users, and accessing or modifying any data within the realm. The attack requires network access, low privileges, and knowledge of an administrator's username or UUID.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access and modification of sensitive data, violating compliance requirements for GDPR and HIPAA. Unauthorized administrative access may result in data breaches, improper data handling, and failure to maintain data integrity and confidentiality, potentially leading to legal and regulatory penalties.

Useful 0 Not Useful 0

Mitigation Strategies

Remove hardcoded-claim protocol mappers from clients with manage-clients permissions. Restrict manage-clients permissions to trusted users only. Monitor for unauthorized realm administrator actions via Admin REST API logs.

Useful 0 Not Useful 0