EUVD-2026-39474
GHSA-q929-g23j-2rc7
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Possession of a previously issued RAT constitutes low-privilege access (PR:L), not unauthenticated; no availability impact applies.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
Lifecycle Timeline
1DescriptionCVE.org
A flaw was found in Keycloak's client registration service. A remote attacker, possessing a previously issued Registration Access Token (RAT), could exploit this vulnerability to re-enable a client that an administrator had explicitly disabled. This bypasses security controls, allowing the attacker to reset the client's secret and potentially regain privileged API access. The primary impact includes unauthorized information disclosure and potential integrity compromise.
AnalysisAI
Keycloak's client registration service fails to invalidate Registration Access Tokens (RATs) when an administrator explicitly disables a client, allowing any holder of a previously issued RAT to re-enable that client and reset its secret. Affected product is Red Hat Build of Keycloak (all versions per available CPE data). An attacker who retains or obtains a valid RAT for a disabled client can restore its operational status, reset OAuth2/OIDC credentials, and resume unauthorized API access - directly undermining an administrator's intentional revocation action. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Technical ContextAI
Keycloak is a widely-deployed open-source Identity and Access Management (IAM) platform implementing OAuth2, OpenID Connect, and SAML. Its client registration service allows programmatic client management using Registration Access Tokens - long-lived bearer tokens issued at client registration time. CWE-613 (Insufficient Session Expiration) identifies the root cause: the RAT is not invalidated or scoped to the client's enabled/disabled lifecycle state. When an administrator disables a client - a deliberate revocation action - Keycloak does not correspondingly revoke or invalidate the associated RAT. The affected CPE is cpe:2.3:a:red_hat:red_hat_build_of_keycloak:*:*:*:*:*:*:*:* (wildcard across all versions), indicating the flaw spans the entire product line without a confirmed minimum version boundary.
RemediationAI
No specific patched version has been identified from the available data - the CPE uses a wildcard and no fix version is cited in the references. Patch availability should be confirmed directly via the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-9705 and Bugzilla issue 2481878. Until a patch is applied, specific compensating controls include: auditing and revoking all Registration Access Tokens associated with administratively disabled clients via the Keycloak Admin Console or Admin REST API (note: manual effort scales poorly in large deployments); restricting network access to the client registration endpoint (typically /realms/{realm}/clients-registrations) to trusted IP ranges only, accepting the trade-off of breaking legitimate automated registration workflows; and implementing short RAT expiry policies for new client registrations where the deployment permits. Do not rely on client disablement alone as a security boundary until the patch is confirmed applied.
More in Red Hat Build Of Keycloak
View allAccount takeover in Red Hat Build of Keycloak allows an unauthenticated attacker to abuse the reset-credentials flow in
Account takeover in Keycloak (Red Hat build of Keycloak, Red Hat Single Sign-On 7) arises because the IdP-initiated SAML
Authentication bypass in Red Hat Build of Keycloak (and Red Hat Single Sign-On 7) lets an unauthenticated attacker forge
Privilege escalation in Red Hat Build of Keycloak's Dynamic Client Registration (DCR) grants an attacker with low-privil
Authorization bypass in the Keycloak Policy Enforcer allows any authenticated user to circumvent all enforced access con
URI normalization bypass in Keycloak's Authorization Services PathMatcher allows authenticated low-privilege users to re
Privilege escalation in Keycloak's Dynamic Client Registration (DCR) component allows attackers with standard user accou
Token exchange in Keycloak bypasses Google Workspace domain allowlist restrictions, enabling any valid Google account ho
Signature-verification bypass in Keycloak (and Red Hat's Keycloak-based products such as Red Hat Single Sign-On 7 and Re
Tenant-restriction bypass in Keycloak's Microsoft identity provider integration allows attackers holding any valid Micro
Session hijacking via SAML assertion replay in Keycloak's SAML broker component allows adjacent-network attackers to aut
Open redirect in Red Hat build of Keycloak permits remote attackers to send victims to attacker-controlled hosts by abus
Same weakness CWE-613 – Insufficient Session Expiration
View allSame technique Information Disclosure
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today