Search for vulnerabilities
Vulnerability details: VCID-hg9y-2gqq-uufd
Vulnerability ID VCID-hg9y-2gqq-uufd
Aliases CVE-2024-3656
GHSA-2cww-fgmg-4jqc
Summary Keycloak's admin API allows low privilege users to use administrative functions Users with low privileges (just plain users in the realm) are able to utilize administrative functionalities within Keycloak admin interface. This issue presents a significant security risk as it allows unauthorized users to perform actions reserved for administrators, potentially leading to data breaches or system compromise. **Acknowledgements:** Special thanks to Maurizio Agazzini for reporting this issue and helping us improve our project.
Status Published
Exploitability 2.0
Weighted Severity 8.0
Risk 10.0
Affected and Fixed Packages Package Details
Weaknesses (5)
CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
CWE-269 Improper Privilege Management
CWE-284 Improper Access Control
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
cvssv3.1 8.1 https://access.redhat.com/errata/RHSA-2024:3572
generic_textual HIGH https://access.redhat.com/errata/RHSA-2024:3572
ssvc Track https://access.redhat.com/errata/RHSA-2024:3572
cvssv3.1 8.1 https://access.redhat.com/errata/RHSA-2024:3575
generic_textual HIGH https://access.redhat.com/errata/RHSA-2024:3575
ssvc Track https://access.redhat.com/errata/RHSA-2024:3575
cvssv3 8.1 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-3656.json
cvssv3.1 8.1 https://access.redhat.com/security/cve/CVE-2024-3656
generic_textual HIGH https://access.redhat.com/security/cve/CVE-2024-3656
ssvc Track https://access.redhat.com/security/cve/CVE-2024-3656
epss 0.8333 https://api.first.org/data/v1/epss?cve=CVE-2024-3656
epss 0.8333 https://api.first.org/data/v1/epss?cve=CVE-2024-3656
epss 0.8333 https://api.first.org/data/v1/epss?cve=CVE-2024-3656
epss 0.87177 https://api.first.org/data/v1/epss?cve=CVE-2024-3656
epss 0.88292 https://api.first.org/data/v1/epss?cve=CVE-2024-3656
epss 0.88292 https://api.first.org/data/v1/epss?cve=CVE-2024-3656
epss 0.88292 https://api.first.org/data/v1/epss?cve=CVE-2024-3656
cvssv3.1 8.1 https://bugzilla.redhat.com/show_bug.cgi?id=2274403
generic_textual HIGH https://bugzilla.redhat.com/show_bug.cgi?id=2274403
ssvc Track https://bugzilla.redhat.com/show_bug.cgi?id=2274403
cvssv3.1 8.1 https://github.com/advisories/GHSA-2cww-fgmg-4jqc
cvssv3.1_qr HIGH https://github.com/advisories/GHSA-2cww-fgmg-4jqc
generic_textual HIGH https://github.com/advisories/GHSA-2cww-fgmg-4jqc
ssvc Track https://github.com/advisories/GHSA-2cww-fgmg-4jqc
cvssv3.1 8.1 https://github.com/hnsecurity/vulns/blob/main/HNS-2024-08-Keycloak.md
generic_textual HIGH https://github.com/hnsecurity/vulns/blob/main/HNS-2024-08-Keycloak.md
cvssv3.1 8.1 https://github.com/keycloak/keycloak
generic_textual HIGH https://github.com/keycloak/keycloak
cvssv3.1 8.1 https://github.com/keycloak/keycloak/commit/d9f0c84b797525eac55914db5f81a8133ef5f9b1
generic_textual HIGH https://github.com/keycloak/keycloak/commit/d9f0c84b797525eac55914db5f81a8133ef5f9b1
cvssv3.1 8.1 https://github.com/keycloak/keycloak/security/advisories/GHSA-2cww-fgmg-4jqc
cvssv3.1_qr HIGH https://github.com/keycloak/keycloak/security/advisories/GHSA-2cww-fgmg-4jqc
generic_textual HIGH https://github.com/keycloak/keycloak/security/advisories/GHSA-2cww-fgmg-4jqc
cvssv3.1 8.1 https://news.ycombinator.com/item?id=42136000
generic_textual HIGH https://news.ycombinator.com/item?id=42136000
cvssv3.1 8.1 https://nvd.nist.gov/vuln/detail/CVE-2024-3656
generic_textual HIGH https://nvd.nist.gov/vuln/detail/CVE-2024-3656
cvssv3.1 8.1 https://security.humanativaspa.it/an-analysis-of-the-keycloak-authentication-system
generic_textual HIGH https://security.humanativaspa.it/an-analysis-of-the-keycloak-authentication-system
Reference id Reference type URL
https://access.redhat.com/errata/RHSA-2024:3572
https://access.redhat.com/errata/RHSA-2024:3575
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-3656.json
https://access.redhat.com/security/cve/CVE-2024-3656
https://api.first.org/data/v1/epss?cve=CVE-2024-3656
https://bugzilla.redhat.com/show_bug.cgi?id=2274403
https://github.com/advisories/GHSA-2cww-fgmg-4jqc
https://github.com/hnsecurity/vulns/blob/main/HNS-2024-08-Keycloak.md
https://github.com/keycloak/keycloak
https://github.com/keycloak/keycloak/commit/d9f0c84b797525eac55914db5f81a8133ef5f9b1
https://github.com/keycloak/keycloak/security/advisories/GHSA-2cww-fgmg-4jqc
https://news.ycombinator.com/item?id=42136000
https://nvd.nist.gov/vuln/detail/CVE-2024-3656
https://security.humanativaspa.it/an-analysis-of-the-keycloak-authentication-system
https://security.humanativaspa.it/an-analysis-of-the-keycloak-authentication-system/
cpe:/a:redhat:build_keycloak: https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/a:redhat:build_keycloak:
cpe:/a:redhat:build_keycloak:22 https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/a:redhat:build_keycloak:22
cpe:/a:redhat:jboss_enterprise_application_platform:8 https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/a:redhat:jboss_enterprise_application_platform:8
cpe:/a:redhat:red_hat_single_sign_on:7 https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/a:redhat:red_hat_single_sign_on:7
cpe:/a:redhat:red_hat_single_sign_on:7.6 https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/a:redhat:red_hat_single_sign_on:7.6
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N Found at https://access.redhat.com/errata/RHSA-2024:3572
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2024-10-09T19:18:03Z/ Found at https://access.redhat.com/errata/RHSA-2024:3572
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N Found at https://access.redhat.com/errata/RHSA-2024:3575
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2024-10-09T19:18:03Z/ Found at https://access.redhat.com/errata/RHSA-2024:3575
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-3656.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N Found at https://access.redhat.com/security/cve/CVE-2024-3656
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2024-10-09T19:18:03Z/ Found at https://access.redhat.com/security/cve/CVE-2024-3656
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N Found at https://bugzilla.redhat.com/show_bug.cgi?id=2274403
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2024-10-09T19:18:03Z/ Found at https://bugzilla.redhat.com/show_bug.cgi?id=2274403
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N Found at https://github.com/advisories/GHSA-2cww-fgmg-4jqc
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2024-10-09T19:18:03Z/ Found at https://github.com/advisories/GHSA-2cww-fgmg-4jqc
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N Found at https://github.com/hnsecurity/vulns/blob/main/HNS-2024-08-Keycloak.md
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N Found at https://github.com/keycloak/keycloak
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N Found at https://github.com/keycloak/keycloak/commit/d9f0c84b797525eac55914db5f81a8133ef5f9b1
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N Found at https://github.com/keycloak/keycloak/security/advisories/GHSA-2cww-fgmg-4jqc
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N Found at https://news.ycombinator.com/item?id=42136000
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2024-3656
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N Found at https://security.humanativaspa.it/an-analysis-of-the-keycloak-authentication-system
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.99217
EPSS Score 0.8333
Published At July 30, 2025, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2025-07-31T08:35:09.284060+00:00 GithubOSV Importer Import https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/06/GHSA-2cww-fgmg-4jqc/GHSA-2cww-fgmg-4jqc.json 37.0.0