Bug 2496889 (CVE-2026-14614)

Summary: CVE-2026-14614 keycloak-services: keycloak-services: FGAP v2 client scope assignment bypass via ClientResource
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: anujha, aschwart, asoldano, aszczucz, bbaranow, bmaxwell, boliveir, bstansbe, dlofthou, drichtar, istudens, ivassile, iweiss, mosmerov, mposolda, msvehla, nwallace, pberan, pesilva, pjindal, pmackay, rmartinc, rstancel, security-response-team, ssilvert, sthorger, thjenkin, vdosoudi, vmuzikar
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in the ClientResource component of Keycloak's admin services when Fine-Grained Admin Permissions (FGAP) v2 is enabled. This issue allows a delegated administrator, who should only have limited control over specific clients, to attach or remove hidden client scopes that they are not authorized to see or manage. As a result, an attacker could inject unauthorized data or permissions into the security tokens issued to end-users, potentially tricking other applications into granting higher levels of access than intended.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-07-03 15:13:33 UTC 
A write-path authorization bypass vulnerability exists in the ClientResource.addDefaultClientScope() and related endpoints in Keycloak when adminPermissionsEnabled is set to true (FGAP v2). The flaw stems from insufficient permission validation: the code only verifies that the caller has manage permissions on the target client but fails to check if the caller has any permissions (such as view or map) on the client scope being attached.
An attacker with a delegated admin role (Clients:view and Clients:manage on at least one client) can exploit this by discovering the UUID of a "hidden" client scope (one they are otherwise restricted from accessing). By calling the client scope assignment endpoints, the attacker can successfully link these hidden scopes to their managed client.
Concrete Impact:
Unauthorized Claim Injection: Attacker can inject claims from restricted client scopes into end-user access tokens.

Authorization Bypass in Relying Apps: Applications relying on Keycloak token claims for internal authorization decisions may grant unauthorized access based on the injected claims.

Data Exposure: If the hidden scope contains sensitive hardcoded claims or mappers, these are exposed to the end-user and the relying application.