Back github.com

Keycloak Issues 53057

github.com • October 13, 2026

A flaw was found in Keycloak's Fine-Grained Admin Permissions (FGAP). The Admin REST API endpoint for deleting user credentials ( DELETE /admin/realms/{realm}/users/{id}/credentials/{credentialId} ) enforces only the generic user-management permission ( requireManage ) and does not check the narrower reset-password permission. A delegated administrator who holds VIEW and MANAGE on a target user but is explicitly denied RESET_PASSWORD can still delete that user's stored password credential, bypassing the intended access control boundary and locking the victim out of their account.

This is related to CVE-2026-94001 .

Observed at commit c6e9851ea1ea821055f5dd11ace033aa9ebf5e15 .

When a delegated administrator attempts to delete a password credential for a user and an explicit negative RESET_PASSWORD policy is in effect, the request should be rejected with HTTP 403 Forbidden — consistent with the behavior of POST /admin/realms/{realm}/users/{id}/reset-password , which already enforces this check correctly.

The DELETE /admin/realms/{realm}/users/{id}/credentials/{credentialId} endpoint accepts the request and removes the password credential. A delegated administrator with an explicit RESET_PASSWORD denial can therefore delete the victim's password credential, resulting in account lockout.

Root cause: UserResource.removeCredential() calls auth.users().requireManage(user) without also calling requireResetPassword(user) when the credential type is PASSWORD . The neighboring method setCredentialUserLabel() already gates on requireResetPassword() for any credential mutation, making this an inconsistency rather than an intentional design.

Scope: the fix applies to password credential removal only. Removal of other credential types (OTP, etc.) remains under requireManage() , consistent with how disableCredentialType() and moveCredentialAfter() already behave.

Related issue: KEYCLOAK-1189 Add apache httpclient module with slot 4.3 #1183 shares the same root cause through a different endpoint (generic user PUT leading to credential injection rather than deletion). Separate CVEs were assigned per CNA guidance.

CVE advisory: GHSA-p353-3p63-7h28

This issue was originally tracked in the private repository. Migrated by @abstractj .

abstractj added priority/important Must be worked on very soon Must be worked on very soon area/admin/fine-grained-permissions Fine-grained admin permissions (FGAP v2) — per-resource authorization Fine-grained admin permissions (FGAP v2) — per-resource authorization kind/cve Issues identified as CVEs on third-party dependencies, or issues which Keycloak is not affected Issues identified as CVEs on third-party dependencies, or issues which Keycloak is not affected backport/main team/core-iam on Sep 22, 2026

github-project-automation added this to Keycloak Roadmap on Sep 22, 2026

abstractj added backport/26.4 backport/26.6 on Sep 22, 2026

abstractj added the cve issue type on Sep 22, 2026

github-project-automation moved this to Open in Keycloak Roadmap on Sep 22, 2026

vramik self-assigned this on Sep 23, 2026

abstractj added severity/medium 50 calendar days to fix 50 calendar days to fix on Sep 30, 2026

vramik added 3 commits that reference this issue on Oct 1, 2026 Admin credential DELETE bypasses denied reset-password permission This issue will close once commit 396d18c is merged into the 'master' branch. 396d18c Admin credential DELETE bypasses denied reset-password permission This issue will close once commit 146d394 is merged into the 'master' branch. 146d394 Admin credential DELETE bypasses denied reset-password permission This issue will close once commit e731804 is merged into the 'master' branch. e731804