CVE-2026-94001 is a missing authorization vulnerability in the Admin REST API of Red Hat Build of Keycloak. The API endpoint responsible for deleting user credentials does not properly enforce fine-grained reset-password permissions. Consequently, delegated administrators who should be restricted from resetting passwords can delete user password credentials, leading to account lockout. The root cause is a missing authorization check for the reset-password permission in the credential deletion API. The vulnerability has been assessed as moderate severity by Red Hat, requiring high privilege for exploitation and resulting in integrity and availability impacts.

Successful exploitation allows a delegated administrator to delete user password credentials despite lacking reset-password permissions. This causes affected users to be unable to log in, effectively locking out accounts. The vulnerability bypasses intended fine-grained permission restrictions, impacting integrity by modifying sensitive credential data and availability by denying user access. No confidentiality impact is reported. Exploitation requires high privileges as a delegated administrator.

According to the Red Hat advisory, no mitigation is currently available or meets criteria for ease of use, applicability, or stability. Users should monitor the vendor advisory for updates regarding patches or mitigations. Until a fix is released, restricting delegated administrator privileges and carefully controlling access to the Admin REST API may reduce risk.