CVE-2024-3656: Keycloak: unguarded admin rest api endpoints allows low privilege users to use administrative functionalities

Severity: high (CVSS 8.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.3% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2024-10-09 · updated 2026-10-09
Weakness: CWE-200

Description

A flaw was found in Keycloak. Certain endpoints in Keycloak's admin REST API allow low-privilege users to access administrative functionalities. This flaw allows users to perform actions reserved for administrators, potentially leading to data breaches or system compromise.

Affected products

Red Hat build of Keycloak 26.4: all versions
Red Hat Single Sign-On 7: all versions

References

https://access.redhat.com/errata/RHSA-2024:3572
https://access.redhat.com/errata/RHSA-2024:3575
https://access.redhat.com/security/cve/CVE-2024-3656
https://bugzilla.redhat.com/show_bug.cgi?id=2274403
https://github.com/advisories/GHSA-2cww-fgmg-4jqc
https://github.com/hnsecurity/vulns/blob/main/HNS-2024-08-Keycloak.md
https://news.ycombinator.com/item?id=42136000
https://security.humanativaspa.it/an-analysis-of-the-keycloak-authentication-system/

Get alerted when CVE-2024-3656 or the next vulnerability affects your stack