A flaw was found in Keycloak. An authenticated user with the uma_protection role can bypass User-Managed Access (UMA) policy validation. This allows the attacker to include resource identifiers owned by other users in a policy creation request, even if the URL path specifies an attacker-owned resource. Consequently, the attacker gains unauthorized permissions to victim-owned resources, enabling them to obtain a Requesting Party Token (RPT) and access sensitive information or perform unauthorized actions.

A flaw was found in Keycloak. An authenticated user with the uma_protection role can bypass User-Managed Access (UMA) policy validation. This allows the attacker to include resource identifiers owned by other users in a policy creation request, even if the URL path specifies an attacker-owned resource. Consequently, the attacker gains unauthorized permissions to victim-owned resources, enabling them to obtain a Requesting Party Token (RPT) and access sensitive information or perform unauthorized actions.

A flaw was found in Keycloak. An authenticated user with the uma_prote ...

Keycloak: UMA Policy Resource Injection Allows Unauthorized Cross-User Permission Grants

Уязвимость программного средства для управления идентификацией и доступом Keycloak, связанная с некорректным порядком поведения, позволяющая нарушителю получить несанкционированный доступ к конфиденциальной информации