Keycloak: unguarded admin rest api endpoints allows low privilege users to use administrative functionalities

published 2024-06-11 2 y ago modified 2026-10-09 30 d ago also GHSA-2cww-fgmg-4jqc , EUVD-2024-1880

cvss: 8.1; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 3.3%; EPSS 3.3% chance of exploitation in 30 days, percentile 88%
public exploits: 0; none known, plus a Nuclei check

A flaw was found in Keycloak. Certain endpoints in Keycloak's admin REST API allow low-privilege users to access administrative functionalities. This flaw allows users to perform actions reserved for administrators, potentially leading to data breaches or system compromise.

Patch / fix

fixed in 1 links 1

maven org.keycloak:keycloak-services 24.0.5

github.com/keycloak/keycloak@d9f0c84 commit

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2024-3656 updated 2026-10-09 cvss 8.1

keycloak: Unguarded admin REST API endpoints allows low privilege users to use administrative functionalities

Red Hat Build of Keycloak org.keycloak-keycloak-parent org.keycloak-keycloak-parent Red Hat Single Sign-On 7 org.keycloak-keycloak-parent org.keycloak-keycloak-parent
affected: workaround, no fix available
Red Hat Build of Keycloak
fixed: vendor fix RHSA-2024:3575
Red Hat Single Sign-On 7
fixed: vendor fix RHSA-2024:3572
Red Hat JBoss Enterprise Application Platform 8 org.keycloak-keycloak-parent org.keycloak-keycloak-parent
not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: total
Assessed: 2 y ago (2024-10-09)

Exploit prediction

3.32% chance of exploitation in the next 30 days, higher than 88% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

Nuclei template Keycloak < 24.0.5 - Broken Access Control nuclei detection template

CVSS scores

assigned by	version	score	vector
CNA	3.1	8.1	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
GitHub	3.1	8.1	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Affected packages

ecosystem	package	affected	fixed in
maven	org.keycloak:keycloak-services	<24.0.5	24.0.5

Affected products

Red Hat Red Hat Build of Keycloak
Red Hat Red Hat Single Sign-On 7
Red Hat Red Hat JBoss Enterprise Application Platform 8

Classification

Weakness

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
CWE-269 Improper Privilege Management
CWE-284 Improper Access Control

References

github.com /keycloak/keycloak/commit/d9f0c84b797525eac55914db5f81a8133ef5f9b1
web
access.redhat.com /errata/RHSA-2024:3572
vendor-advisory, web
access.redhat.com /errata/RHSA-2024:3575
vendor-advisory, web
access.redhat.com /security/cve/CVE-2024-3656
vdb-entry, web
bugzilla.redhat.com /show_bug.cgi?id=2274403
issue-tracking, web
github.com /advisories/GHSA-2cww-fgmg-4jqc
advisory
security.humanativaspa.it /an-analysis-of-the-keycloak-authentication-system/
news.ycombinator.com /item?id=42136000
web
github.com /hnsecurity/vulns/blob/main/HNS-2024-08-Keycloak.md
web
github.com /keycloak/keycloak/security/advisories/GHSA-2cww-fgmg-4jqc
web
nvd.nist.gov /vuln/detail/CVE-2024-3656
advisory
github.com /keycloak/keycloak
package
security.humanativaspa.it /an-analysis-of-the-keycloak-authentication-system
web

Sources

CVE List CVE-2024-3656
GitHub Advisory GHSA-2cww-fgmg-4jqc
NVD CVE-2024-3656

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary