CVE-2024-3656
HIGH8.1EPSS 89.7%Keycloak's admin API allows low privilege users to use administrative functions
Published: 6/11/2024Modified: 2/4/2026
Description
Users with low privileges (just plain users in the realm) are able to utilize administrative functionalities within Keycloak admin interface. This issue presents a significant security risk as it allows unauthorized users to perform actions reserved for administrators, potentially leading to data breaches or system compromise. **Acknowledgements:** Special thanks to Maurizio Agazzini for reporting this issue and helping us improve our project.
Affected packages (1)
- Maven/org.keycloak:keycloak-servicesfrom 0, < 24.0.5
CVSS scores
| Source | Version | Severity | Vector |
|---|---|---|---|
| osv | CVSS 3.1 | HIGH8.1 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N |
References (12)
- ADVISORYhttps://github.com/advisories/GHSA-2cww-fgmg-4jqc
- ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2024-3656
- PATCHhttps://github.com/keycloak/keycloak
- WEBhttps://access.redhat.com/errata/RHSA-2024:3572
- WEBhttps://access.redhat.com/errata/RHSA-2024:3575
- WEBhttps://access.redhat.com/security/cve/CVE-2024-3656
- WEBhttps://bugzilla.redhat.com/show_bug.cgi?id=2274403
- WEBhttps://github.com/hnsecurity/vulns/blob/main/HNS-2024-08-Keycloak.md
- WEBhttps://github.com/keycloak/keycloak/commit/d9f0c84b797525eac55914db5f81a8133ef5f9b1
- WEBhttps://github.com/keycloak/keycloak/security/advisories/GHSA-2cww-fgmg-4jqc
- WEBhttps://news.ycombinator.com/item?id=42136000
- WEBhttps://security.humanativaspa.it/an-analysis-of-the-keycloak-authentication-system