CVE-2026-97177

Executive Summary

CVE-2026-97177 is an improper authorization vulnerability (CWE-862, "Missing Authorization") in the user update mechanism of the Keycloak Admin REST API. When Fine-Grained Admin Permissions (FGAP) are enabled, the system fails to verify specific password-reset authorizations during a general user profile update, allowing a delegated administrator who should be restricted from resetting passwords to change another user's credentials and fully take over that account. Any Keycloak deployment that uses delegated administration with FGAP enabled and contains lower-privileged administrative accounts is in scope; the CVSS v3.1 base score is 6.6 (Medium).

Technical Analysis

Keycloak is an open-source identity and access management (IAM) solution that exposes an administrative interface through the Keycloak Admin REST API. Organizations frequently delegate subsets of administrative capability — for example, help-desk or tenant-level administrators — and use Fine-Grained Admin Permissions (FGAP) to constrain exactly which operations those delegated administrators may perform on which users. FGAP is the authorization layer that is supposed to evaluate granular permissions such as "may this administrator reset this user's password?"

The vulnerability resides in the user update mechanism of the Admin REST API. When FGAP is enabled, an update to a user profile is expected to trigger authorization checks for each sensitive attribute being modified — including the credential/password field. Per the NVD description, the system "fails to check for specific password reset authorizations during a general user profile update." In other words, the authorization decision for a password change is not enforced when that password change arrives as part of a broader user-profile update operation.

The flaw class is a missing authorization check (CWE-862): the code path that processes a general user update does not invoke the granular permission evaluation that a dedicated password-reset operation would require. This is a classic "authorization bypass via alternate code path" pattern, in which a guarded operation (dedicated password reset) has an unguarded equivalent reachable through a different API operation (general user update).

Attack surface: the Keycloak Admin REST API, reachable over the network (AV:N). The attacker must already possess a delegated administrator account (PR:H) and the attack requires conditions specific to the deployment's authorization configuration — namely FGAP being enabled and a delegated admin whose permissions exclude password resets (AC:H). No user interaction is required (UI:N), and the impact is scoped to the compromised user's security context (S:U).

The NVD description does not disclose specific endpoint paths, parameter names, function names, or the exact request body used. No affected version range, patch commit, or vendor advisory has been published. Accordingly, the precise implementation location of the missing check cannot be stated and is not inferred here.

Exploitation Scenarios

No public proof-of-concept, Nuclei template, or exploit code is available. The attack chain below is described at the vulnerability-class level, strictly consistent with the NVD description.

1. Reconnaissance / target identification. The attacker identifies a Keycloak deployment with the Admin REST API exposed and confirms that Fine-Grained Admin Permissions are enabled. The attacker obtains a legitimate but restricted delegated-administrator account — for example a help-desk or tenant admin whose FGAP configuration grants profile-edit rights but explicitly denies password-reset rights. Such credentials may be obtained through phishing, credential reuse, insider access, or compromise of a less-protected administrative workstation.

2. Triggering the flaw. Using the delegated-admin session, the attacker performs a general user profile update against a target user through the Admin REST API instead of invoking the dedicated password-reset operation. Because the user update mechanism does not evaluate the specific password-reset authorization for the credential field, the FGAP restriction that would have blocked a dedicated reset is not applied. The update therefore proceeds with a credential change requested by an administrator who was never authorized to change credentials.

3. Payload / execution method. At the vulnerability-class level, the payload is an authorized-looking administrative request that modifies the target user's profile and includes a credential change. The dedicated, guarded password-reset path is deliberately bypassed in favor of the unguarded general update path. The NVD description does not disclose the request schema, field names, or endpoint, so no specific payload structure is asserted here.

4. Post-exploitation impact. The attacker sets a known credential on the victim account and authenticates as that user. Because Keycloak is an identity provider, this yields full account takeover of the victim, and the attacker inherits every application, role, and downstream federated system that trusts that identity. If the victim holds elevated privileges (e.g., an application administrator or another Keycloak administrator), the attacker can escalate further within the environment. Persistence may be achieved by adding new credentials or sessions to the taken-over account.

Impact Assessment

The CVSS v3.1 base score is 6.6 (Medium) with vector CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H. Subscore interpretation:

• Confidentiality: High (C:H) — the attacker gains full access to the victim account and any data or services reachable through it.
• Integrity: High (I:H) — the attacker can modify the victim's credentials and, by extension, the authentication state of downstream systems.
• Availability: High (A:H) — control of an account can deny the legitimate user access and can disrupt dependent services that rely on that identity.
• Attack Vector: Network (AV:N) — exploitation occurs over the network via the Admin REST API.
• Attack Complexity: High (AC:H) — success depends on the deployment having FGAP enabled and on the attacker holding a delegated-admin account that lacks password-reset rights.
• Privileges Required: High (PR:H) — the attacker must already be an authenticated delegated administrator.
• User Interaction: None (UI:N) and Scope: Unchanged (S:U).

Business impact: a Keycloak administrator's account takeover directly undermines the integrity of the identity provider itself. Any account controlled by the victims (workforce users, service accounts, or further administrators) can be compromised, enabling lateral movement into every relying party. Blast radius is deployment-wide and extends to federated identity consumers. Because exploitation requires privileged delegated access and a specific FGAP configuration, mass opportunistic exploitation is unlikely, but the vulnerability is highly relevant to insider threats, compromised delegated-admin credentials, and post-compromise privilege escalation within IAM infrastructure. EPSS has not yet been scored by FIRST.org and there is no CISA KEV listing; no evidence of active exploitation in the wild is currently available.

Detection Guidance

Detection strategy centers on correlating administrative identity operations with the acting principal's intended authorization scope. Because no public exploit artifacts exist, the rules below target the behavior described in the NVD description — a general user profile update that results in a credential change performed by a delegated administrator — rather than a known payload signature. Administrators should baseline normal Admin REST API activity first to reduce false positives.

Sigma Rule

title: Potential Keycloak FGAP Authorization Bypass via User Update
id: 8f3c1a2e-97177-4b6d-9c0e-keycloak0
status: experimental
description: Detects a general user profile update that results in a credential/password change, consistent with CVE-2026-97177 authorization bypass.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-97177
author: valtersit.com
date: 2026/01/01
logsource:
  product: keycloak
  service: admin-events
detection:
  selection_action:
    operation|contains:
      - 'UPDATE_USER'
      - 'UPDATE'
  selection_target:
    resourceType: 'USER'
  selection_cred:
    'representation|contains|all':
      - 'credentials'
  selection_admin:
    authDetails.realmId|exists: true
    authDetails.userId|exists: true
  condition: selection_action and selection_target and selection_cred and selection_admin
falsepositives:
  - Legitimate full-privilege admin password resets performed via user update
level: high
tags:
  - attack.t1078
  - attack.persistence

YARA Rule

rule CVE_2026_97177_Keycloak_FGAP_Password_Update
{
    meta:
        author = "valtersit.com"
        description = "Detects Keycloak admin API request payloads that combine user update actions with a credentials field, consistent with CVE-2026-97177 FGAP authorization bypass"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-97177"
        date = "2026-01-01"
        severity = "high"

    strings:
        $op_update   = "UPDATE" ascii wide nocase
        $res_user    = "USER" ascii wide nocase
        $cred1       = "credentials" ascii wide nocase
        $cred2       = "password" ascii wide nocase
        $admin_path1 = "/admin/realms/" ascii wide
        $admin_path2 = "/users/" ascii wide

    condition:
        uint16(0) == 0x7B or
        (($op_update and $res_user and ($cred1 or $cred2)) and
         (($admin_path1 and $admin_path2)))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-97177 Possible Keycloak FGAP Authorization Bypass - User Credential Update via Admin REST API"; flow:established,to_server; http.method; content:"PUT"; http.uri; content:"/admin/realms/"; http.uri; content:"/users/"; http.request_body; content:"credentials"; http.request_body; content:"password"; reference:cve,2026-97177; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-97177; classtype:attempted-admin; sid:202697177; rev:1; metadata:created_at 2026_01_01, updated_at 2026_01_01, confidence Medium, signature_severity Major;)

Elastic Detection

sequence by user.name with maxspan=30s
  [ authentication where event.action == "LOGIN" and
      user.roles in ("realm-admin", "delegated-admin", "manage-users") ]
  [ http where http.request.method == "PUT" and
      http.url rlike ".*/admin/realms/.*/users/.*" and
      http.request.body contains "credentials" and
      http.request.body contains "password" ]

Splunk SPL Query

index=keycloak sourcetype=keycloak:server
(operation=UPDATE_USER OR operation=UPDATE OR "UPDATE_USER" OR "update user")
resourceType=USER
| eval has_cred=if(match(_raw,"(?i)credentials|password"),1,0)
| where has_cred=1
| stats count min(_time) as firstTime max(_time) as lastTime
        values(authDetails.userId) as admin_user
        values(resourcePath) as target_user
        by operation, resourceType, clientId, ipAddress
| where count >= 1
| convert ctime(firstTime) ctime(lastTime)
| sort - count

Wazuh OSSEC Rule

<group name="keycloak,access_control,">
  <rule id="971770" level="3">
    <decoded_as>json</decoded_as>
    <field name="operation">UPDATE_USER|UPDATE</field>
    <description>Keycloak: user update operation observed</description>
  </rule>

  <rule id="971771" level="12">
    <if_sid>971770</if_sid>
    <field name="resourceType">USER</field>
    <match>credentials|password</match>
    <description>CVE-2026-97177 - Keycloak delegated admin performed user update containing credential/password change (possible FGAP authorization bypass)</description>
    <mitre>
      <id>T1078</id>
    </mitre>
    <group>admin_access,gdpr_IV_35.7.d,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix, workaround, or affected version range has been published, and no affected-versions or OSV package data is available. The measures below are defensive and configuration-oriented; none of them are confirmed vendor mitigations.

1. Immediate mitigations

• Treat the vulnerability as exploitable only by delegated administrators, and urgently review every account holding delegated administrative roles on Keycloak realms where Fine-Grained Admin Permissions are enabled.
• Enforce least privilege on administrative roles: ensure nobody holds broader permissions than their function requires, and audit FGAP configurations for accounts that were intended to be denied password-reset rights.
• Invalidate and rotate credentials for administrative accounts, and require phishing-resistant MFA (hardware/FIDO2) for all admin console and Admin REST API access.
• Restrict network reachability of the Administrative REST API (and admin console) to trusted management networks, bastion hosts, or VPN-only access, reducing the exposed attack surface.
• Centralize and retain Keycloak admin event and audit logs so credential-change operations can be reviewed retroactively.

2. Patch / upgrade steps

• No patch is currently available (0/4 sources show a fix). Monitor the Keycloak project's official security advisories, release notes, and the NVD entry for CVE-2026-97177 for an affected-version range and a fixed release.
• When a fixed version is published, plan an expedited upgrade after validating compatibility; because this is an authorization-logic fix, patch at the earliest available maintenance release.
• Until a patch exists, do not assume any version is immune — no affected-version data has been published either way.

3. Long-term hardening

• Adopt a policy of periodic review of FGAP and role assignments, and remove stale delegated administrators.
• Monitor the Keycloak project changelog and subscribe to its security announcement channel for future authorization fixes.
• Instrument alerting on anomalous administrative behavior, especially credential changes performed by principals who normally do not perform password resets.
• Consider segmentation of the identity provider's admin plane from the general network and enforce session re-authentication for sensitive admin operations.

References

• NVD — CVE-2026-97177: https://nvd.nist.gov/vuln/detail/CVE-2026-97177
• CWE-862 — Missing Authorization: https://cwe.mitre.org/data/definitions/862.html
• Keycloak Project — official security advisories and release notes: https://www.keycloak.org/ (monitor for CVE-2026-97177 advisory)
• CVSS v3.1 Specification (FIRST.org) — vector interpretation: https://www.first.org/cvss/v3.1/specification-document
• CISA Known Exploited Vulnerabilities Catalog — CVE-2026-97177 is NOT listed as of this writing: https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No public proof-of-concept, exploit code, Nuclei template, or evidence of in-the-wild exploitation or named threat-actor campaign targeting CVE-2026-97177 is currently available. EPSS has not yet assigned a score.