CVE-2026-94001: Keycloak Admin REST API Auth Bypass Flaw

CVE-2026-94001 Overview

CVE-2026-94001 is a missing authorization vulnerability [CWE-862] in the Admin REST API of Keycloak, an open-source identity and access management platform. The endpoint responsible for deleting user credentials fails to enforce fine-grained reset-password permissions. A delegated administrator who is explicitly restricted from resetting passwords can still delete a target user's password credential. The affected user is then locked out and cannot log in, producing an availability and integrity impact on identity operations.

Critical Impact
A delegated administrator without reset-password rights can delete user password credentials through the Admin REST API, locking legitimate users out of the identity provider.

Affected Products

Red Hat Keycloak (Admin REST API)
Red Hat build of Keycloak
Red Hat Single Sign-On (downstream distributions tracked in the Red Hat advisory)

Discovery Timeline

2026-09-19 - CVE-2026-94001 published to the National Vulnerability Database
2026-09-22 - Last updated in the NVD database

Technical Details for CVE-2026-94001

Vulnerability Analysis

The flaw resides in the Keycloak Admin REST API endpoint used to delete user credentials. Keycloak supports fine-grained administrative permissions, allowing operators to grant scoped rights such as manage-users without granting the ability to reset passwords. The credential-deletion path does not evaluate the fine-grained reset-password permission before removing a credential.

An authenticated delegated administrator can send a delete request against a user's credential resource. The server processes the request as a management operation rather than a password-reset operation. The user's password credential is removed, blocking the user from authenticating until an authorized administrator restores access. The issue is tracked under CWE-862 (Missing Authorization).

Root Cause

The root cause is an inconsistent authorization model between password reset and credential deletion. Password reset is gated by the manage-users role plus the fine-grained reset-password permission. Credential deletion, which achieves an equivalent outcome by removing the credential entirely, is gated only by the broader administrative role. This gap allows a restricted administrator to bypass the reset-password control by using deletion as an alternate path.

Attack Vector

Exploitation requires an authenticated account with delegated administrative access to the target realm. The attacker issues an HTTP DELETE request to the Admin REST API path that removes a specific credential for a target user. Because the endpoint does not check the fine-grained reset-password permission, the request succeeds. No user interaction is required. The attack is executed over the network against the Keycloak administration interface.

No verified public proof-of-concept code is available. Refer to the Red Hat CVE-2026-94001 Advisory and Red Hat Bug Report #2537169 for vendor technical details.

Detection Methods for CVE-2026-94001

Indicators of Compromise

Unexpected HTTP DELETE requests to Admin REST API paths of the form /admin/realms/{realm}/users/{id}/credentials/{credentialId} originating from delegated administrator accounts.
Keycloak admin event log entries with operation type DELETE on resource type USER or CREDENTIAL performed by principals that lack the reset-password fine-grained permission.
Sudden increase in end-user authentication failures with reason invalid_user_credentials immediately following administrative credential-delete events.

Detection Strategies

Enable Keycloak admin events and forward them to a centralized log platform, then alert on credential-delete operations correlated with the acting administrator's assigned permissions.
Baseline normal administrative activity per realm and flag credential deletions performed by delegated administrators rather than realm or master admins.
Correlate admin credential-delete events with subsequent failed login attempts from the affected user within a short time window.

Monitoring Recommendations

Ingest Keycloak KC_ADMIN_EVENTS and authentication event streams into a SIEM or data lake for continuous review.
Monitor for anomalous access patterns against /admin/realms/*/users/*/credentials/* endpoints.
Review privileged role assignments regularly and alert when accounts without reset-password execute credential modification operations.

How to Mitigate CVE-2026-94001

Immediate Actions Required

Apply the Keycloak patched release referenced in the Red Hat CVE-2026-94001 Advisory as soon as it is available for your distribution.
Audit delegated administrator role assignments and remove manage-users from accounts that do not require it.
Review admin event logs for prior credential-delete operations executed by accounts lacking the reset-password fine-grained permission.

Patch Information

Red Hat tracks remediation for downstream Keycloak, Red Hat build of Keycloak, and Red Hat Single Sign-On packages in the vendor advisory. Consult the Red Hat CVE-2026-94001 Advisory and Red Hat Bug Report #2537169 for fixed versions and errata identifiers specific to each supported product stream.

Workarounds

Restrict access to the Keycloak Admin REST API to a limited administrative network segment until the patch is applied.
Reduce the number of delegated administrator accounts and enforce least privilege by consolidating user-management duties under fully trusted operators.
Enable and actively monitor admin event logging so that any credential deletion is reviewed and can be quickly reversed by restoring the user's credential.

bash

# Example: list Keycloak admin events for credential deletions using kcadm.sh
kcadm.sh get events/admin -r <realm> \
  -q operationType=DELETE \
  -q resourceType=USER