CVE-2026-109081Medium· 6.8▾ SunlitA flaw was found in Keycloak. The Dynamic Client Registration (DCR) endpoint does not properly validate authorization when processing the deprecated defaultRoles field. An authenticated attacker with client creation privileges or an Init…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 37.4 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
A flaw was found in Keycloak. The Dynamic Client Registration (DCR) endpoint does not properly validate authorization when processing the deprecated defaultRoles field. An authenticated attacker with client creation privileges or an Initial Access Token (IAT) can inject excessive roles into the realm's default roles configuration. This causes clients across the realm to generate bloated access tokens, resulting in performance and memory degradation that can lead to a Denial of Service (DoS).
keycloak-services (all versions)rhbk/keycloak-rhel9 (all versions)keycloak-servicesRefer to the linked advisories for vendor-supplied fixes and affected version ranges.
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-96547Medium· 6.5Keycloak-services: keycloak-services: dcr registration-time claim-path gap allows forging realm_access.roles
CVE-2026-114232High· 8.1Keycloak-services: keycloak-services: uma protection api resourcetype field not validated — cross-owner resource access
CVE-2026-117627Medium· 5.4Keycloak-services: keycloak-services: jwt authorization grant bypasses identity provider login restrictions
CVE-2026-107623Medium· 4.3A flaw was found in the OIDC Dynamic Client Registration (DCR) component of Keycloak
CVE-2026-105306Medium· 6.5A flaw was found in the Dynamic Client Registration flow of the Keycloak identity and access management server
CVE-2026-97311Medium· 4.3A flaw was found in the Admin REST API of Keycloak, an identity and access management solution