CVE-2026-94001

Overview

A permission validation flaw exists in the Admin REST API of Keycloak related to user credential deletion. Specifically, the endpoint fails to properly enforce fine-grained reset-password permissions for delegated administrators. This matters because restricted administrators can exploit this gap to delete user passwords, leading to a denial of service for affected users.

Description

A flaw was found in the Admin REST API of Keycloak, an open-source identity and access management solution. The endpoint used for deleting user credentials does not correctly check for fine-grained reset-password permissions. This allows a delegated administrator, who should be restricted from resetting passwords, to delete a user's password credentials, resulting in the user being unable to log in.

Impact

The vulnerability results in a loss of availability for targeted users whose password credentials are deleted, impacting confidentiality and integrity indirectly through service disruption. Delegated administrators with restricted privileges are the threat actors who can exploit this vector. The attack is localized to the authentication service, potentially disrupting organizational access control.

Remediation

Apply the official security patch or upgrade to the latest supported version of Keycloak where fine-grained permission checks are correctly enforced on the credential deletion endpoint. Review and audit delegated administrator roles to ensure least-privilege access is maintained. Monitor authentication and API logs for unusual credential deletion activities.

Risk context

This vulnerability is rated as high severity with a CVSS v3 score of 6.5, though EPSS data is currently unavailable. The risk is primarily operational, causing service disruption rather than direct system compromise, but requires prompt remediation to prevent administrative abuse.

Affected products

• Keycloak Admin REST API
• Keycloak Identity and Access Management