CVE-2026-94217

Executive Summary

CVE-2026-94217 is an authorization logic flaw in the User-Managed Access (UMA) implementation of Keycloak, specifically in the authorization token endpoint that processes permission tickets. When two distinct users own resources that share the same name, the system incorrectly merges the permission sets from both resources during authorization token issuance, allowing an attacker to obtain access scopes on another user's resource that were never intended to be shared. The vulnerability carries a CVSS 3.1 base score of 3.5 (AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N), indicating a low-severity integrity impact that requires authenticated attacker access and some degree of victim interaction.

Technical Analysis

The flaw resides in Keycloak's UMA authorization token endpoint. UMA (User-Managed Access) is an OAuth 2.0 extension in which a resource owner delegates access to protected resources through a centralized authorization server. A requesting party obtains a permission ticket from the resource server, then presents that ticket to the authorization server's token endpoint to exchange it for a Requesting Party Token (RPT) containing the granted scopes.

The defect is a resource-identity collision. When permission tickets are processed, the system resolves the target resource by name rather than by a globally unique resource identifier. If two different users each own a resource sharing the same name, the authorization logic fails to disambiguate ownership and merges the permission sets of both resources. The consequence is scope confusion: the requesting user receives an RPT that includes scopes belonging to the victim's same-named resource.

This maps to CWE-862 (Missing Authorization), where the system does not correctly enforce the authorization boundary between two distinct security principals. The root cause is an incorrect assumption that resource names are unique within the evaluation scope, resulting in cross-tenant permission bleed. The NVD description does not disclose specific class names, method names, endpoint paths, or parameter identifiers beyond the "authorization token endpoint" and "permission tickets," so no implementation-level detail beyond these terms should be assumed.

Attack surface: the UMA token endpoint is network-exposed (AV:N), the attack is low complexity (AC:L) because it depends on a predictable naming collision rather than race conditions or memory corruption, but it requires the attacker to hold a valid low-privileged account (PR:L) and some user interaction element is reflected in the vector (UI:R).

Exploitation Scenarios

No public proof-of-concept, Nuclei template, or exploit code is available for CVE-2026-94217. The attack chain below is inferred strictly from the vulnerability class and the NVD description; no specific function names or endpoints beyond those stated are asserted.

1. Reconnaissance / target identification. The attacker registers or obtains a low-privileged account on a Keycloak realm that has UMA enabled. They identify a victim user who owns a UMA-protected resource, and determine that a resource name they can also create or already own will collide with the victim's resource name. Resource naming may be observable through legitimate UMA resource registration flows or user-facing resource listings.

2. Triggering the flaw class. The attacker creates (or already possesses) a resource whose name matches the victim's resource name. Because the authorization logic resolves resources by name rather than by unique identifier, the two distinct resources now collide within the permission-ticket evaluation path.

3. Execution at the vulnerability-class level. The attacker initiates an authorization request for their own colliding resource, causing the authorization token endpoint to issue a permission ticket that is then exchanged for a token. During processing, the endpoint merges the permission sets from both resources, and the resulting token carries the victim's scopes. The UI:R component reflects that the flow may require the resource owner or a consent step in some deployment configurations.

4. Post-exploitation impact. The attacker gains access scopes on the victim's resource that were never intended to be shared. The integrity impact is limited (I:L) because the attacker obtains unintended read/action scope on a single colliding resource rather than full administrative control, and confidentiality is not directly impacted (C:N) per the vector. The practical effect is unauthorized access to another user's protected UMA resource under a same-name condition.

Impact Assessment

Business impact is bounded but real: any Keycloak deployment with UMA enabled and multi-tenant or multi-user resource naming is potentially affected. The blast radius is limited to the specific colliding resources; the CVSS vector (C:N/I:L/A:N, S:U) confirms no confidentiality breach, a low integrity impact, and no availability impact, and scope remains unchanged. Affected systems are Keycloak authorization servers exposing the UMA token endpoint. Because exploitation requires a valid account and a name collision, mass exploitation is unlikely, but targeted abuse in shared or multi-tenant realms is plausible. No affected version range has been confirmed, so all UMA-enabled deployments should be treated as potentially at risk until version-specific guidance is available.

Detection Guidance

Sigma Rule

title: Keycloak UMA Permission Ticket Cross-Resource Scope Merge
id: 3f7c1a92-6b4d-4e21-9a0f-2d5c8e7b1f34
status: experimental
description: Detects UMA authorization token requests potentially exploiting same-name resource permission merge (CVE-2026-94217)
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-94217
author: valtersit.com
logsource:
  product: keycloak
  service: uma
detection:
  selection:
    event_type: 'UMA_TOKEN_REQUEST'
  keywords:
    - 'permission_ticket'
    - 'authorization'
  condition: selection
level: low

YARA Rule

rule CVE_2026_94217_Keycloak_UMA_ScopeMerge
{
    meta:
        description = "Detects UMA permission ticket handling references related to CVE-2026-94217"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-94217"
        date = "2026-01-01"
    strings:
        $uma1 = "uma-ticket" ascii nocase
        $uma2 = "permission_ticket" ascii nocase
        $uma3 = "authorization/token" ascii nocase
    condition:
        any of them
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-94217 Keycloak UMA Permission Ticket Scope Merge Attempt"; flow:to_server,established; http.method; content:"POST"; http.uri; content:"token"; http.uri; content:"uma"; http.request_body; content:"permission_ticket"; reference:cve,2026-94217; classtype:attempted-user; sid:202694217; rev:1;)

Elastic Detection

sequence by user.name with maxspan=5m
  [ http.request where http.request.method == "POST" and url.path contains "token" and url.path contains "uma" ]
  [ http.response where http.response.status_code == 200 ]

Splunk SPL Query

index=keycloak sourcetype=keycloak:uma (uri_path="*token*" OR body="*permission_ticket*")
| stats count values(uri_path) as paths by user, src_ip
| where count > 0

Wazuh OSSEC Rule

<group name="keycloak,cve-2026-94217">
  <rule id="20294217" level="5">
    <decoded_as>json</decoded_as>
    <field name="event_type">UMA_TOKEN_REQUEST</field>
    <description>CVE-2026-94217: Keycloak UMA authorization token request for permission ticket - possible scope merge abuse</description>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix or workaround has been published for CVE-2026-94217.

1. Immediate mitigations. Where UMA is not required, disable the UMA feature to remove the attack surface. Enforce a resource naming policy that guarantees uniqueness across users (e.g., namespacing resource names with the owner identity) so same-name collisions cannot occur. Restrict resource registration so users cannot create resources whose names collide with resources owned by others. Limit accounts that can reach the UMA token endpoint to trusted principals only.
2. Patch/upgrade steps. Monitor Keycloak security advisories and the CVE entry at https://nvd.nist.gov/vuln/detail/CVE-2026-94217 for an official fix. Once a patched release is available, upgrade all authorization servers and validate that resource permission resolution uses unique identifiers rather than names. Given no affected version range is confirmed, treat any UMA-enabled version as potentially affected.
3. Long-term hardening. Enforce globally unique resource identifiers in UMA authorization decisions and add automated tests for cross-user same-name scenarios. Apply least privilege to client scopes, audit UMA token issuance for cross-resource scope grants, and integrate the detection rules above into SOC monitoring. Reassess the deployment's UMA adoption against the principle of minimal necessity.

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-94217
• CWE-862 Missing Authorization: https://cwe.mitre.org/data/definitions/862.html
• Keycloak project security advisories: https://www.keycloak.org/security
• OAuth 2.0 UMA specification (User-Managed Access): https://docs.kantarainitiative.org/uma/wg/oauth-uma-grant-2.0.html
• CISA KEV Catalog: NOT listed as of this report (no confirmed exploit-in-the-wild evidence).