Keycloak Admin REST API Password Reset Bypass via Fine-Grained Permissions

Executive Summary

This vulnerability is in the Keycloak Admin REST API where a flaw in the user update mechanism allows delegated administrators with Fine-Grained Admin Permissions to bypass password reset restrictions and change a user's credentials, leading to account takeover. The issue arises from a missing authorization check in the user update REST API endpoint.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability requires checking Keycloak Admin REST API logs and configurations for unauthorized credential updates. Look for API calls to /admin/realms/{realm}/users/{userId} with a credentials object in the payload by delegated administrators without explicit reset-password permissions. Review Keycloak server logs for suspicious user update operations and verify Fine-Grained Admin Permissions settings.

Useful 0 Not Useful 0

Impact Analysis

A delegated administrator with manage permissions but no reset-password authority can set a new password for any managed user, gaining unauthorized access to victim accounts or locking legitimate users out. This requires the attacker to already have delegated administrator privileges and Fine-Grained Admin Permissions enabled.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to user accounts, potentially violating data protection requirements under GDPR and HIPAA. Unauthorized credential changes may result in unauthorized data access or disclosure, which are key compliance concerns for these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Disable Fine-Grained Admin Permissions in Keycloak to prevent delegated administrators from bypassing password reset restrictions. Review and restrict delegated administrator privileges to ensure they cannot modify user credentials.

Useful 0 Not Useful 0