| Package | Affected versions | Patched versions |
|---|---|---|
| org.keycloak:keycloak-services | < 26.5.7 | 26.5.7 |
| build of keycloak | = 26.2= 26.2.15= 26.4= 26.4.11 |
A flaw was found in Keycloak. An authenticated user with the uma_protection role can bypass User-Managed Access (UMA) policy validation. This allows the attacker to include resource identifiers owned by other users in a policy creation request, even if the URL path specifies an attacker-owned resource. Consequently, the attacker gains unauthorized permissions to victim-owned resources, enabling them to obtain a Requesting Party Token (RPT) and access sensitive information or perform unauthorized actions.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free