A Missing Authorization vulnerability was discovered in Keycloaks Admin REST API. The flaw exists in the way the API resolves client resources using the per-request in-memory cache in the org.keycloak.models.cache.infinispan component. The cache is keyed by client UUID alone and does not perform a realm ownership validation when a resource is retrieved.
An authenticated attacker with the create-realm role in the master realm can exploit this by creating a new realm and then addressing a master realm client using its UUID through the attacker-controlled realms API path. If the master realm client is present in the per-request cache, the system returns or updates the master client instead of enforcing realm boundaries.
Successful exploitation allows an attacker to:
Read client details, including credentials of confidential clients in the master realm.

Overwrite client configurations, such as injecting arbitrary redirect URIs into built-in master clients like admin-cli or security-admin-console.

Turn the master authorization endpoint into an open redirect.

Potentially affect other resource types that utilize the same per-request cache pattern.