GHSA-W3P3-7CJG-VGFW Keycloak allows unauthorized access to resources via uma permission ticket bypass

Description A flaw was found in org.keycloak.authorization. An authenticated user with a granted User-Managed Access UMA permission ticket for one resource can exploit this by using a specific permission request prefix to bypass per-resource access control. This allows the user to gain unauthoriz...

Keycloak allows unauthorized access to resources via uma permission ticket bypass

Description A flaw was found in org.keycloak.authorization. An authenticated user with a granted User-Managed Access UMA permission ticket for one resource can exploit this by using a specific permission request prefix to bypass per-resource access control. This allows the user to gain unauthoriz...

Duplicate Advisory: Keycloak allows unauthorized access to resources via uma permission ticket bypass

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-w3p3-7cjg-vgfw. This link is maintained to preserve external references. Original Description A flaw was found in org.keycloak.authorization. An authenticated user with a granted User-Managed Access UMA permissi...