Keycloak Identity Provider Client Attribute Bypass

Executive Summary

This vulnerability affects Keycloak's Dynamic Client Registration (DCR) flow. It allows an attacker with a valid Initial Access Token to register a client that bypasses audience checks during token introspection. This means the attacker can view sensitive identity information, roles, and session details from access tokens of other applications in the same realm.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor Keycloak logs for unauthorized client registrations with the attribute 'allow.token.introspection.without.audience.check' set to true. Check for unusual token introspection requests bypassing audience checks. Review client registrations in the Keycloak admin console for suspicious activity.

Useful 0 Not Useful 0

Impact Analysis

If exploited, this vulnerability could allow an attacker to access sensitive user data, roles, and session information from other applications in the same Keycloak realm. This could lead to unauthorized data disclosure or session hijacking, even if the attacker is not the intended recipient of the tokens.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive personal data, violating GDPR's data protection principles and HIPAA's requirements for safeguarding protected health information. Organizations using Keycloak may face compliance violations if this flaw is exploited.

Useful 0 Not Useful 0

Mitigation Strategies

Disable Dynamic Client Registration (DCR) if not required. If DCR is necessary, restrict Initial Access Tokens to trusted sources only. Update Keycloak to the latest version if a patch is available. Monitor and revoke any suspicious client registrations immediately.

Useful 0 Not Useful 0