{"id":"CVE-2026-9797","aliases":["EUVD-2026-117964","GHSA-q88h-q5mj-rq7p"],"status":"published","title":"Keycloak: keycloak: privilege escalation via client authentication manipulation by an authenticated administrator","description":"A flaw was found in Keycloak's administrative services (org.keycloak.services.resources.admin). A highly privileged attacker, authenticated with a 'manage-clients' role, could exploit this vulnerability through several methods, including manipulating client JSON Web Key Sets (JWKS), swapping client authenticator types and resetting secrets, or downloading legitimate signing keys. Successful exploitation allows the attacker to obtain a token with 'realm-admin' role assignments, leading to privilege escalation and potential unauthorized access to sensitive resources.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00317,"percentile":0.24866,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-266"],"published":"2026-11-06T06:36:10Z","modified":"2026-11-06T09:31:31Z","products":[{"vendor":"red hat","product":"red hat build of keycloak"}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-9797","tags":["vdb-entry","x_refsource_REDHAT"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2482468","tags":["issue-tracking","x_refsource_REDHAT"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-9797"},{"url":"https://github.com/advisories/GHSA-q88h-q5mj-rq7p"}],"sources":{"cve":[{"id":"CVE-2026-9797","title":"Keycloak: keycloak: privilege escalation via client authentication manipulation by an authenticated administrator","description":"A flaw was found in Keycloak's administrative services (org.keycloak.services.resources.admin). A highly privileged attacker, authenticated with a 'manage-clients' role, could exploit this vulnerability through several methods, including manipulating client JSON Web Key Sets (JWKS), swapping client authenticator types and resetting secrets, or downloading legitimate signing keys. Successful exploitation allows the attacker to obtain a token with 'realm-admin' role assignments, leading to privilege escalation and potential unauthorized access to sensitive resources.","status":"published","published":"2026-11-06T06:36:10.498Z","modified":"2026-11-06T17:35:07.672Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-266"],"updated_at":"2026-11-06T18:59:09.209977Z"}],"euvd":[{"id":"EUVD-2026-117964","description":"A flaw was found in Keycloak's administrative services (org.keycloak.services.resources.admin). A highly privileged attacker, authenticated with a 'manage-clients' role, could exploit this vulnerability through several methods, including manipulating client JSON Web Key Sets (JWKS), swapping client authenticator types and resetting secrets, or downloading legitimate signing keys. Successful exploitation allows the attacker to obtain a token with 'realm-admin' role assignments, leading to privilege escalation and potential unauthorized access to sensitive resources.","status":"published","published":"2026-11-06T06:36:10Z","modified":"2026-11-06T17:35:07Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N","level":"medium"}],"updated_at":"2026-11-06T18:05:39.47551Z"}],"ghsa":[{"id":"GHSA-q88h-q5mj-rq7p","title":"A flaw was found in Keycloak's administrative services (org.keycloak.services.resources.admin). A...","description":"A flaw was found in Keycloak's administrative services (org.keycloak.services.resources.admin). A highly privileged attacker, authenticated with a 'manage-clients' role, could exploit this vulnerability through several methods, including manipulating client JSON Web Key Sets (JWKS), swapping client authenticator types and resetting secrets, or downloading legitimate signing keys. Successful exploitation allows the attacker to obtain a token with 'realm-admin' role assignments, leading to privilege escalation and potential unauthorized access to sensitive resources.","status":"published","published":"2026-11-06T09:31:30Z","modified":"2026-11-06T09:31:31Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N","level":"medium"}],"cwes":["CWE-266"],"updated_at":"2026-11-06T09:59:38.586951Z"}],"nvd":[{"id":"CVE-2026-9797","description":"A flaw was found in Keycloak's administrative services (org.keycloak.services.resources.admin). A highly privileged attacker, authenticated with a 'manage-clients' role, could exploit this vulnerability through several methods, including manipulating client JSON Web Key Sets (JWKS), swapping client authenticator types and resetting secrets, or downloading legitimate signing keys. Successful exploitation allows the attacker to obtain a token with 'realm-admin' role assignments, leading to privilege escalation and potential unauthorized access to sensitive resources.","status":"published","published":"2026-11-06T07:18:06.34Z","modified":"2026-11-06T18:18:34.013Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-266"],"updated_at":"2026-11-06T20:01:16.80823Z"}]}}