A flaw was found in the User-Managed Access (UMA) implementation of Keycloak. The issue occurs in the authorization token endpoint when proc…
A flaw was found in the User-Managed Access (UMA) implementation of Keycloak. The issue occurs in the authorization token endpoint when processing permission tickets. If two different users own resources with the same name, the system incorrectly merges the permissions from both resources when one user requests an authorization token. This allows an attacker to gain access scopes on a victim's resource that were never intended to be shared.
▸ Remotely exploitable over the network — no physical or local access required
▸ Low attack complexity — no special conditions needed to exploit
▸ Requires low-privilege access first
▸ Requires the victim to take an action (e.g. open a file or link)
Apply the vendor patch as soon as it's available or already released. Review and restrict accounts with the privilege level this vulnerability requires. User-awareness training reduces risk here, since exploitation depends on tricking a user into acting.
This analysis is generated from structured CVSS vector data, CISA KEV cross-referencing, and vendor/product category rules — not a manual expert review. Treat it as a starting point, not a substitute for your own assessment.
CVSS Vector Breakdown
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
