CVE-2026-94001

Received Received - Intake

Keycloak Admin REST API Password Credential Deletion Flaw

Publication date: 2026-09-19

Last updated on: 2026-09-19

Assigner: redhat-SADP

Description

A flaw was found in the Admin REST API of Keycloak, an open-source identity and access management solution. The endpoint used for deleting user credentials does not correctly check for fine-grained reset-password permissions. This allows a delegated administrator, who should be restricted from resetting passwords, to delete a user's password credentials, resulting in the user being unable to log in.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-19

Last Modified

2026-09-19

Generated

2026-09-20

AI Q&A

2026-09-20

EPSS Evaluated

N/A

NVD

CVE-2026-94001

Affected Vendors & Products

Vendor	Product	Version / Range
keycloak	keycloak	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

This vulnerability is in Keycloak's Admin REST API. It allows a delegated administrator without proper reset-password permissions to delete a user's password credentials. This prevents the user from logging in.

Detection Guidance

This vulnerability affects the Keycloak Admin REST API. To detect it, check Keycloak server logs for unauthorized deletion of user credentials via the Admin REST API endpoint. Look for DELETE requests to /admin/realms/{realm}/users/{userId}/credentials/{credentialId} without proper reset-password permissions.

Impact Analysis

If exploited, this flaw could lock users out of their accounts by removing their password credentials. This disrupts access to services relying on Keycloak for authentication.

Compliance Impact

This vulnerability could impact compliance with GDPR and HIPAA by allowing unauthorized deletion of user credentials. Under GDPR, unauthorized access or deletion of user data may violate principles of data integrity and security. For HIPAA, improper credential management could compromise protected health information integrity and availability.

Mitigation Strategies

Update Keycloak to the latest version where this flaw is patched. Review delegated administrator permissions to ensure they do not have unnecessary rights to delete user credentials. Monitor logs for unauthorized credential deletions.

Hi! I’m here to help you understand CVE-2026-94001. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70