Bug 2450244 (CVE-2026-4629)

Summary:	CVE-2026-4629 keycloak: Keycloak: Privilege escalation through hardcoded role mapper injection
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	aschwart, aszczucz, boliveir, drichtar, mposolda, pjindal, rmartinc, security-response-team, ssilvert, sthorger, vmuzikar
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in Keycloak. A highly privileged user with `manage-clients` permission can exploit this vulnerability by injecting a hardcoded role mapper into any client. This action allows the user to bypass existing scope restrictions and inject the `realm-admin` role into generated tokens, resulting in privilege escalation and full administrative access to the realm.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Deadline:	2026-04-20

Description OSIDB Bzimport 2026-03-23 08:02:58 UTC

A user with manage-clients permission can escalate to realm-admin by
injecting a hardcoded role mapper into any client. The mapper injects
realm-admin into tokens at generation time, bypassing scope
restrictions.

*Steps to reproduce:*

1. Create a user with only manage-clients role (no user/role/realm access)
2. As attacker, add oidc-hardcoded-role-mapper to any client with
config: {"role": "realm-management.realm-admin"}
3. Authenticate through that client
4. Token is generated with realm-admin role injected (bypasses
fullScopeAllowed: false)
5. Use token to call admin API — full realm-admin access confirmed