CVE-2026-9099: Keycloak Group Reparenting Authorization Bypass – Privilege Escalation to Realm Takeover

Technical summary

The vulnerability exists in the GroupResource.addChild() endpoint of Keycloak's Admin REST API. When Fine-Grained Admin Permissions v2 (FGAPv2) is enabled, the endpoint fails to properly validate whether an authenticated user has authorization to reparent a group. An attacker with admin privileges scoped to a single group can invoke this endpoint to move an arbitrary group—including those with elevated roles such as realm-admin—into a child position beneath their managed group. Because Keycloak implements hierarchical permission inheritance for group management, the reparenting action causes the attacker to inherit administrative control over the reparented group's members. This missing authorization check is rooted in CWE-639 (Authorization Bypass Through User-Controlled Key), where the attacker can manipulate group structure parameters to bypass intended privilege boundaries.

Business impact

A successful exploitation grants an attacker with limited admin credentials the ability to escalate privileges to full realm control. The attack chain is particularly dangerous because it targets identity and access management infrastructure: compromising a Keycloak realm means an attacker can reset any user's password, impersonate any identity, and modify access policies across all dependent applications. Organizations relying on Keycloak for centralized authentication and authorization would experience a complete loss of confidentiality, integrity, and availability of their identity layer. This extends the blast radius to every application and service consuming Keycloak authentication.

Affected systems

Red Hat build of Keycloak is the confirmed affected product. The vulnerability is only exploitable when Fine-Grained Admin Permissions v2 (FGAPv2) is enabled—organizations running standard Keycloak deployments without FGAPv2 enabled are not susceptible to this particular attack vector. However, FGAPv2 represents the modern permission model for Keycloak and is likely enabled in security-conscious deployments, making this a concern for a significant subset of Keycloak users.

Exploitability

Exploitation requires an authenticated attacker with existing admin privileges, albeit limited in scope (e.g., managing only one group). The attack is network-accessible and requires no user interaction. The CVSS score of 7.7 (HIGH) reflects the high-complexity nature of the attack (requiring specific FGAPv2 configuration and scoped admin credentials), but the impact severity is significant given the privilege escalation potential and path to realm takeover. The vulnerability is not currently listed on the CISA Known Exploited Vulnerabilities (KEV) catalog, suggesting active in-the-wild exploitation has not yet been widely documented, though the simplicity of the attack vector once privileges are obtained makes this a high-priority defensive concern.

Remediation

Obtain and apply the security patch from Red Hat for Keycloak. Given the severity of the vulnerability and the ease of exploitation for a privileged attacker, patching should be prioritized immediately. Until a patch is available or deployed, mitigate by disabling Fine-Grained Admin Permissions v2 (FGAPv2) if your operational model permits, or by strictly limiting the number of admin users who have group management rights. Monitor admin API calls to the GroupResource.addChild() endpoint for suspicious reparenting operations, particularly moves involving high-privilege groups.

Patch guidance

Contact Red Hat and verify the specific patch version for your Keycloak build through the official security advisory. Apply patches in a staged manner: test in a non-production environment first, then deploy to production with appropriate change management. Verify that FGAPv2 remains enabled post-patch and that group hierarchies have not been maliciously altered during the window of vulnerability. Consider performing a post-patch audit of group structure and permissions to detect any unauthorized reparenting that may have occurred.

Detection guidance

Monitor Admin REST API logs, specifically the GroupResource.addChild() endpoint, for unusual group reparenting operations. Flag any attempts to move high-privilege groups (those with roles like realm-admin) under other groups managed by lower-privileged admins. Implement alerting on group hierarchy changes that violate your expected organizational structure. Check for password reset operations by low-privilege admins targeting high-privilege user accounts, which may indicate post-exploitation activity. Review IAM audit logs for unauthorized privilege escalation or lateral movement following any detected group reparenting.

Why prioritize this

Despite not appearing on the CISA KEV list, this vulnerability merits immediate prioritization because it directly compromises Keycloak—a critical identity infrastructure component. The attack requires only compromised low-privilege admin credentials (a realistic threat model) and directly enables full realm takeover. The HIGH CVSS score, combined with the foundational nature of Keycloak in authentication stacks, makes this a top-tier remediation candidate. Organizations should treat this similarly to critical authentication bypass vulnerabilities.

Risk score, explained

The CVSS 3.1 score of 7.7 reflects: high impact (complete compromise of confidentiality, integrity across a realm) but moderated by the requirement for an authenticated attacker with admin credentials and FGAPv2-enabled configuration. The HIGH severity is appropriate given the access required is not simply network-unauthenticated; however, in environments where admin credentials are routinely distributed across teams or potentially compromised, the exploitability rises substantially. The high-complexity vector (AC:H) acknowledges that not all Keycloak instances have FGAPv2 enabled, reducing the attack surface compared to an unauthenticated flaw, but organizations with modern permission models should view this as HIGH-critical in practice.

Frequently asked questions