rootpwn

medium · CVSS v3 6.6 · EPSS 0.00237

CVE-2026-97177

A flaw in Keycloak's Admin REST API allows a delegated administrator to reset a user's password without proper authorization when Fine‑Grain

Overview

A flaw in Keycloak's Admin REST API allows a delegated administrator to reset a user's password without proper authorization when Fine‑Grained Admin Permissions are enabled. This can lead to account takeover and unauthorized access to protected resources. The issue is limited to the user update endpoint and requires the attacker to have delegated admin privileges.

Description

A flaw was found in the user update mechanism of the Keycloak Admin REST API. When Fine-Grained Admin Permissions are enabled, the system fails to check for specific password reset authorizations during a general user profile update. This allows a delegated administrator, who should be restricted from resetting passwords, to change a user's credentials and take over their account.

Impact

The vulnerability compromises confidentiality and integrity of user accounts by enabling unauthorized password changes. Administrators and end users are directly impacted, as compromised accounts can be used to access sensitive data or further elevate privileges. Organizations relying on Keycloak for identity management must assess the risk of internal privilege misuse.

Remediation

Apply the latest Keycloak patch that enforces password‑reset authorization checks in the user update API. If patching is delayed, disable Fine‑Grained Admin Permissions or restrict delegated admin roles to exclude password‑reset capabilities. Additionally, enable audit logging for password changes and regularly review logs for anomalous activity.

Risk context

The CVE has a medium severity score (CVSS 6.6) and a low EPSS of 0.00237, indicating a moderate risk that is unlikely to be widely exploited but still warrants timely remediation.

Affected products

  • Keycloak

Scores

Severity
medium
CVSS v2
6.8
CVSS v3
6.6
CVSS v4
—
EPSS
0.00237

keycloak admin-api password-reset privilege-escalation fine-grained-permissions

← All CVEs

Related CVEs

medium

CVE-2026-96892

A flaw has been found in Edimax BR-6428nC 1.16. The impacted element is the function websRedirect of the component goform Handler. Executing a manipulation of the argument submit-url can lead to open redirect. The attack may be launched remotely. The exploit has been published and may be used. Multiple endpoints are affected. The vendor was contacted early about this disclosure but did not respond in any way.

View analysis

medium

CVE-2026-96763

A flaw in kvcache-ai mooncake’s ScopedSegmentAccess::MountSegment function allows remote attackers to bypass access controls. The vulnerability exists in versions up to 0.3.12, 0.3.13.post1, and 0.3.14-rc1. It can lead to unauthorized data access or modification.

View analysis

medium

CVE-2026-96764

kvcache-ai mooncake up to 0.3.12/0.3.14-rc1 contains a resource allocation flaw in MasterService::GetReplicaListByRegex. Remote attackers can trigger excessive memory usage, potentially leading to denial of service. The vulnerability is publicly known and unpatched.

View analysis

medium

CVE-2026-96772

A security flaw has been discovered in Intelliants Subrion CMS up to 4.2.1. This affects an unknown part of the file /actions.json?action=assign-owner. The manipulation of the argument q results in information disclosure. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

View analysis