EUVD-2026-51924
GHSA-r6f5-hj4x-7mq7
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Network-accessible registration API requires low-privilege delegated account; omitting a field is low complexity; no availability impact and scope is unchanged.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
Lifecycle Timeline
1DescriptionCVE.org
A flaw was found in the full-scope-disabled client-policy executor within the keycloak-services component. This component is responsible for enforcing security policies during client registration and configuration in Red Hat Build of Keycloak. The issue occurs because the executor only validates the fullScopeAllowed field when it is explicitly provided in a request. By omitting this field, a delegated user can bypass the policy, resulting in a client created with full scope access. This allows the client to obtain tokens with unauthorized role mappings.
AnalysisAI
The full-scope-disabled client-policy executor in Red Hat Build of Keycloak silently skips enforcement when the fullScopeAllowed attribute is absent from a client registration or update request, allowing a delegated user to create OAuth/OIDC clients with unrestricted scope access. Affected platforms span Red Hat Build of Keycloak, Red Hat Single Sign-On 7, Red Hat Data Grid 8, and JBoss EAP Expansion Pack. An attacker holding delegated registration privileges (CVSS PR:L) can exploit this to issue tokens containing unauthorized role mappings, effectively escalating their effective permissions within any application trusting those tokens. No public exploit code or CISA KEV entry has been identified at time of analysis.
Technical ContextAI
Keycloak's client policy framework allows realm administrators to enforce security constraints on OAuth/OIDC client registration via pluggable executor components within keycloak-services. The full-scope-disabled executor is specifically designed to prevent registered clients from inheriting fullScopeAllowed=true, a flag that causes Keycloak to include all available role mappings in issued tokens regardless of the client's declared scopes. The root cause is CWE-862 (Missing Authorization): the executor performs its validation conditionally - only when the fullScopeAllowed field is explicitly present in the request payload. When the field is omitted, the check is bypassed entirely and Keycloak defaults to granting full scope, undermining the policy's intent. Affected CPE strings include cpe:2.3:a:red_hat:red_hat_build_of_keycloak, cpe:2.3:a:red_hat:red_hat_single_sign-on_7, cpe:2.3:a:red_hat:red_hat_data_grid_8, and cpe:2.3:a:red_hat:red_hat_jboss_enterprise_application_platform_expansion_pack.
RemediationAI
Apply the vendor-released patch as documented in the Red Hat security advisory at https://access.redhat.com/security/cve/CVE-2026-18570; no exact fixed version was confirmed in available data at time of analysis, so this advisory must be consulted directly for the correct errata package. As an immediate compensating control, administrators should restrict delegated client registration and update permissions to fully trusted accounts only, accepting the trade-off of reduced self-service capability - this eliminates the low-privilege attack path required for exploitation. Realm administrators should also audit all existing client configurations to identify clients where fullScopeAllowed=true was unintentionally granted, and revoke that flag where it is not explicitly required. If the full-scope-disabled executor is not actively needed in a realm's client policy, disabling delegated registration entirely is the most effective mitigation until a patch is applied.
More in Red Hat Build Of Keycloak
View allAccount takeover in Red Hat Build of Keycloak allows an unauthenticated attacker to abuse the reset-credentials flow in
Account takeover in Keycloak (Red Hat build of Keycloak, Red Hat Single Sign-On 7) arises because the IdP-initiated SAML
Authentication bypass in Red Hat Build of Keycloak (and Red Hat Single Sign-On 7) lets an unauthenticated attacker forge
Privilege escalation in Red Hat Build of Keycloak's Dynamic Client Registration (DCR) grants an attacker with low-privil
Mismatched handling of the HTTP/1 absolute-form request authority in Red Hat build of Quarkus and other affected Red Hat
Authorization bypass in the Keycloak Policy Enforcer allows any authenticated user to circumvent all enforced access con
URI normalization bypass in Keycloak's Authorization Services PathMatcher allows authenticated low-privilege users to re
Privilege escalation in Keycloak's Dynamic Client Registration (DCR) component allows attackers with standard user accou
Token exchange in Keycloak bypasses Google Workspace domain allowlist restrictions, enabling any valid Google account ho
Signature-verification bypass in Keycloak (and Red Hat's Keycloak-based products such as Red Hat Single Sign-On 7 and Re
Tenant-restriction bypass in Keycloak's Microsoft identity provider integration allows attackers holding any valid Micro
Session hijacking via SAML assertion replay in Keycloak's SAML broker component allows adjacent-network attackers to aut
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allVendor StatusVendor
Debian
Bug #1088287| Release | Status | Fixed Version | Urgency |
|---|---|---|---|
| open | - | - |
Share
External POC / Exploit Code
Leaving vuln.today