Keycloak UMA token endpoint resource ownership confusion

Confirmed. CVSS 3.5 (low). No active exploitation. Patch is out.

What it is

User-Managed Access (UMA) is an OAuth 2.0-based delegation protocol that lets a resource owner grant access to their resources without being directly involved in each authorization exchange. Keycloak implements UMA 2.0. The protocol issues “permission tickets,” which the authorization server resolves into RPT (Requesting Party Tokens) — the tokens a client uses to prove it has been granted access to a protected resource.

CVE-2026-94217 is in the UMA authorization token endpoint. When two different users own separate resources and a single permission ticket covers both, Keycloak’s endpoint produces unexpected behavior at that ownership boundary. The specific behavior: the requesting party token reflects authorization for a resource belonging to a different owner than the requesting user. In practical terms, a low-privileged authenticated user in a specific UMA delegation scenario can potentially obtain an RPT that includes access to a resource they should not own or control.

Red Hat’s advisory describes this as resource ownership confusion in the UMA token endpoint. The flaw affects Keycloak deployments with UMA enabled and shared resource environments where multiple users own distinct resources.

Scope

CVSS 3.5 is low, but the score reflects a narrow exploitation path, not the potential downstream impact. Authorization tokens issued by Keycloak are trusted by every service in the realm. A token that incorrectly reflects access to another user’s resource is not inherently constrained to the IAM layer: any downstream service relying on RPT claims without secondary validation will honor the confused token.

Exploitation requires an authenticated session. The attacker must be a legitimate user in the realm, and the target environment must use UMA resource sharing with multiple resource owners. Single-owner deployments are not affected by the ownership boundary logic.

No unauthenticated access path. Not on CISA’s Known Exploited Vulnerabilities catalog.

Affected deployments

UMA is not enabled by default in all Keycloak configurations. Organizations most likely affected:

• Multi-tenant SaaS platforms using Keycloak’s resource server integration with UMA for customer-level resource ownership
• Healthcare and government portals where Keycloak manages delegated authorization across multiple user principals
• Any environment where resource ownership is shared or delegated using Keycloak’s Authorization Services module with the UMA protection API

If your deployment does not use Authorization Services or UMA protection, CVE-2026-94217 is not a factor. Confirm by checking whether your resource server registers resources via the UMA registration endpoint.

Patch

Apply the patched Keycloak version listed in the Red Hat advisory. Red Hat published the advisory on September 21, 2026. No workaround short of patch has been documented for this specific flaw; disabling UMA entirely eliminates the attack surface if patching is not immediately possible.

Context

IAM flaws carry asymmetric risk. CVSS scores measure direct exploitability against a single system; they do not capture the trust amplification that identity systems provide. An attacker who manipulates what an RPT claims can move laterally through any service in the realm that trusts Keycloak-issued tokens. The low score here reflects constraints on the path to exploit, not on the consequences if exploitation succeeds.

Keycloak is deployed widely in enterprise, healthcare, and government environments. It functions as an identity broker, SSO provider, and authorization server. IAM infrastructure is a consistent initial-access and privilege-escalation target.

The same September 21 Red Hat patch batch includes three other Keycloak CVEs: CVE-2026-94218 (CVSS 3.1, session enforcement bypass), CVE-2026-94213 (CVSS 4.9, Authorization Services policy evaluation exposure), and CVE-2026-94215 (CVSS 5.5, Admin REST API client cache flaw). Apply all four in one maintenance pass.

Full coverage: Red Hat Patches Four Keycloak IAM Flaws. September 21 briefing: Sep 21: REDCap 9.8 RCE, Keycloak IAM, Jade Sleet Backdoors.