Uri Rolls

**Name of the Vulnerable Software and Affected Versions** Keycloak (affected versions not specified) **Description** A flaw allows a highly privileged user with `manage-clients` permission to perform privilege escalation by injecting a hardcoded role mapper into any client. This process enables the user to bypass scope restrictions and inject the `realm-admin` role into generated tokens, granting full administrative access to the realm. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Keycloak (affected versions not specified) **Description** An authenticated administrator possessing the `manage-clients` role can exploit a Time-of-check to time-of-use (TOCTOU) flaw—a race condition where a system checks a condition and then uses the result, but the condition changes between the check and the use—within the name-based admin role checks. This allows the attacker to escalate privileges to `realm-admin` for all users in the realm, providing extensive system control. The resulting composite role relationship remains active even after the attacker's permissions are revoked or the system is rebooted. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.