An authenticated administrator holding the manage-clients role can exploit a time‑of‑check to time‑of‑use flaw in Keycloak’s name‑based admin role checks. The flaw allows the attacker to elevate privileges to realm‑admin for every user in the realm, providing extensive control over the system. The escalated privilege persists even after the attacker’s original permissions are removed and across system reboots.

Red Hat Build of Keycloak is affected. No specific version range is listed in the CNA data, so all supported releases at the time of the advisory may be vulnerable until patched.

The CVSS score of 6.5 indicates moderate severity, but the vulnerability enables broad privilege escalation, which is a high‑impact outcome. EPSS is not available, so the current exploitation likelihood is unknown, and the CVE is not listed in the CISA KEV catalog. The attack requires authenticated access with the manage‑clients role, so it is an internal threat vector that could be used by privileged users or those who compromise such accounts. The flaw remains even after revocation or system reboots, making it particularly dangerous if not mitigated.