EUVD-2026-53398
GHSA-cj2r-7gqh-wx4f
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
S:C assigned because gaining realm-admin access breaks the Keycloak security boundary affecting all downstream relying services; PR:L reflects required client registration credential.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
A flaw was found in Keycloak's Dynamic Client Registration (DCR) security policy management. The "Allowed Protocol Mapper Types" policy, which restricts which types of data mappers a client can use, fails to re-validate the mapper type during a client update if the mapper's configuration remains unchanged. An attacker with client registration privileges can exploit this by first registering an allowed mapper type with a malicious configuration and then swapping it for a restricted, high-privilege mapper type (such as one that hardcodes administrative roles). This allows the attacker to gain full administrative access to the Keycloak realm.
AnalysisAI
Privilege escalation in Red Hat Build of Keycloak's Dynamic Client Registration (DCR) grants an attacker with low-privilege client registration credentials full realm administrator access by exploiting a validation bypass in the 'Allowed Protocol Mapper Types' security policy. The policy correctly validates mapper types at initial registration but fails to re-validate the mapper type during a client update when the mapper's surrounding configuration is unchanged, allowing a type-swap from a permitted mapper to a restricted high-privilege mapper (such as a HardcodedRoleMapper that injects realm-admin roles into tokens). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker must possess a valid credential authorized to register and update clients via the Dynamic Client Registration API in the target Keycloak realm - this is the client_registration_policy privilege, which is a deliberate, low-privilege role distinct from realm administration. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS 8.8 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) correctly captures the network-accessible, low-complexity, low-privilege nature of the attack, but the Unchanged Scope (S:U) designation likely understates the real-world blast radius: gaining realm administrator access in Keycloak breaks the security boundary for every application, user, and service account that relies on that realm for authentication and authorization, which more accurately reflects a scope change (S:C). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker holding valid client registration credentials submits a legitimate DCR request registering a client with a permitted mapper type (e.g., an allowed OIDC User Attribute Mapper) alongside a crafted configuration payload. They then immediately submit a client update request to the DCR API that keeps the mapper configuration fields identical but replaces the mapper type field with a restricted, high-privilege type such as HardcodedRoleMapper set to inject the realm-admin role - the update-path validation, seeing an unchanged configuration, skips mapper type re-validation and persists the change. … |
| Remediation | No specific patched version has been confirmed in the available data; organizations should monitor https://access.redhat.com/security/cve/CVE-2026-15572 and https://bugzilla.redhat.com/show_bug.cgi?id=2499592 for Red Hat's official patch release and targeted fix version, and apply it as soon as available. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: restrict access to Dynamic Client Registration (DCR) endpoints via network controls, WAF rules, or reverse proxy configuration, and review all recent client registration and update activities for unauthorized changes. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Red Hat Build Of Keycloak
View allAccount takeover in Keycloak (Red Hat build of Keycloak, Red Hat Single Sign-On 7) arises because the IdP-initiated SAML
Account takeover in Red Hat Build of Keycloak allows an unauthenticated attacker to abuse the reset-credentials flow in
Authentication bypass in Red Hat Build of Keycloak (and Red Hat Single Sign-On 7) lets an unauthenticated attacker forge
Authorization bypass in the Keycloak Policy Enforcer allows any authenticated user to circumvent all enforced access con
URI normalization bypass in Keycloak's Authorization Services PathMatcher allows authenticated low-privilege users to re
Privilege escalation in Keycloak's Dynamic Client Registration (DCR) component allows attackers with standard user accou
Token exchange in Keycloak bypasses Google Workspace domain allowlist restrictions, enabling any valid Google account ho
Signature-verification bypass in Keycloak (and Red Hat's Keycloak-based products such as Red Hat Single Sign-On 7 and Re
Tenant-restriction bypass in Keycloak's Microsoft identity provider integration allows attackers holding any valid Micro
Session hijacking via SAML assertion replay in Keycloak's SAML broker component allows adjacent-network attackers to aut
Open redirect in Red Hat build of Keycloak permits remote attackers to send victims to attacker-controlled hosts by abus
Identity linking bypass in Red Hat build of Keycloak allows an attacker controlling a second account on the same upstrea
Same technique Information Disclosure
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today