Unauthorized Permission Escalation in Keycloak UMA

Executive Summary

This vulnerability is in Keycloak's User-Managed Access (UMA) implementation. It occurs in the authorization token endpoint when processing permission tickets. If two users own resources with the same name, the system incorrectly merges permissions from both resources when one user requests an authorization token. This allows an attacker to gain access scopes on a victim's resource that were never intended to be shared.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor Keycloak logs for unusual permission ticket processing or scope merging events. Check for multiple users accessing resources with identical names. Review authorization token endpoint logs for Requesting Party Token (RPT) generation failures or unexpected scope assignments.

Useful 0 Not Useful 0

Impact Analysis

An attacker with low privileges can exploit this by creating a resource with the same name as a victim's resource and sharing it with themselves. This allows the attacker to obtain an authorization token containing scopes belonging to the victim's resource, bypassing standard policy checks. Successful exploitation requires the victim to have previously shared their resource.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update Keycloak to the latest patched version. Ensure resource names are unique across all users to prevent collisions. Review and revoke any unintended permission grants resulting from scope merging. Monitor for suspicious activity in authorization token endpoints.

Useful 0 Not Useful 0