Copyright © 2012 Red Hat, Inc. All rights reserved. Moderate 2026-09-19T23:39:17 keycloak-services: keycloak-services: UMA scope merge across resource owners via resource name collision 3.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N CWE-862

A flaw was found in the User-Managed Access (UMA) implementation of Keycloak. The issue occurs in the authorization token endpoint when processing permission tickets. If two different users own resources with the same name, the system incorrectly merges the permissions from both resources when one user requests an authorization token. This allows an attacker to gain access scopes on a victim's resource that were never intended to be shared.

A flaw was found in the User-Managed Access (UMA) implementation of Keycloak. The issue occurs in the authorization token endpoint when processing permission tickets. If two different users own resources with the same name, the system incorrectly merges the permissions from both resources when one user requests an authorization token. This allows an attacker to gain access scopes on a victim's resource that were never intended to be shared.

The Red Hat Product Security team has assessed the severity of this vulnerability as Moderate, given that exploitation requires a specific resource name collision and prior user interaction by the victim. Successful exploitation allows an attacker to gain unauthorized scopes on a victim's UMA resource. The vulnerability's root cause is the improper isolation of resources by owner during the permission ticket lookup process in the authorization token endpoint. Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Red Hat Build of Keycloak Affected keycloak/rhbk-openshift-rhel9 Red Hat Build of Keycloak Affected keycloak-services Red Hat Build of Keycloak Affected rhbk/keycloak-rhel9 Red Hat Single Sign-On 7 Not affected keycloak-services https://www.cve.org/CVERecord?id=CVE-2026-94217 https://nvd.nist.gov/vuln/detail/CVE-2026-94217