A flaw in Keycloak’s Client Policies allows an unauthenticated attacker to bypass the reject-ropc-grant executor when certain condition providers (client-type, client-roles, client-attributes, client-scopes) are used. This bypass enables the attacker to acquire OAuth tokens via a Resource Owner Password Credentials (ROPC) grant even though the policy is intended to block it, providing unauthorized access and potential information disclosure. The weakness falls under CWE-280, indicating an insufficient access control issue.

All installations of the Red Hat Build of Keycloak that enable the affected Client Policies are potentially impacted. No specific version range is listed, so any deployment of this product should be evaluated for the presence of the vulnerable policy configuration.

The CVSS score of 6.5 indicates medium severity. EPSS is not available, and the vulnerability is not listed in CISA’s KEV catalog. The attack vector is likely remote, requiring the attacker to pose as a client or manipulate policy configuration. If the configuration uses the vulnerable combination of condition providers and reject-ropc-grant, an attacker can obtain tokens without authentication.