EUVD-2026-53398
GHSA-cj2r-7gqh-wx4f
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
S:C assigned because gaining realm-admin access breaks the Keycloak security boundary affecting all downstream relying services; PR:L reflects required client registration credential.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
Lifecycle Timeline
2DescriptionCVE.org
A flaw was found in Keycloak's Dynamic Client Registration (DCR) security policy management. The "Allowed Protocol Mapper Types" policy, which restricts which types of data mappers a client can use, fails to re-validate the mapper type during a client update if the mapper's configuration remains unchanged. An attacker with client registration privileges can exploit this by first registering an allowed mapper type with a malicious configuration and then swapping it for a restricted, high-privilege mapper type (such as one that hardcodes administrative roles). This allows the attacker to gain full administrative access to the Keycloak realm.
AnalysisAI
Privilege escalation in Red Hat Build of Keycloak's Dynamic Client Registration (DCR) grants an attacker with low-privilege client registration credentials full realm administrator access by exploiting a validation bypass in the 'Allowed Protocol Mapper Types' security policy. The policy correctly validates mapper types at initial registration but fails to re-validate the mapper type during a client update when the mapper's surrounding configuration is unchanged, allowing a type-swap from a permitted mapper to a restricted high-privilege mapper (such as a HardcodedRoleMapper that injects realm-admin roles into tokens). No public exploit code has been identified and no CISA KEV listing is present, but the attack is low-complexity, fully network-exploitable, and results in complete confidentiality, integrity, and availability compromise of the Keycloak realm.
Technical ContextAI
Keycloak's Dynamic Client Registration (DCR) implements the OAuth 2.0 Dynamic Client Registration Protocol, allowing clients to self-register and self-update with the authorization server via API. The 'Allowed Protocol Mapper Types' DCR security policy restricts which protocol mapper classes a client may configure - protocol mappers are components that transform the claims in issued tokens. A HardcodedRoleMapper, for example, is a restricted mapper that injects a fixed role (including realm-admin) into every token issued to a client, making it a high-value target for privilege escalation. The root cause is CWE-843 (Access of Resource Using Incompatible Type), a type-confusion class flaw: the update-path code path checks whether mapper configuration has changed but does not re-validate the mapper *type* field independently, treating a reconfigured mapper as equivalent to an unchanged one. This breaks the intended security invariant that only allowed mapper types may be associated with dynamically registered clients. The affected product is confirmed by CPE cpe:2.3:a:red_hat:red_hat_build_of_keycloak:*:*:*:*:*:*:*:* across all tracked versions. Note that the intelligence tags 'Memory Corruption' and 'Information Disclosure' appear to be mis-classifications; this vulnerability is a logic-layer authorization bypass, not a memory-safety issue.
RemediationAI
No specific patched version has been confirmed in the available data; organizations should monitor https://access.redhat.com/security/cve/CVE-2026-15572 and https://bugzilla.redhat.com/show_bug.cgi?id=2499592 for Red Hat's official patch release and targeted fix version, and apply it as soon as available. As an immediate compensating control, organizations should disable Dynamic Client Registration entirely if it is not operationally required - this eliminates the attack surface completely at the cost of breaking any OAuth client onboarding workflows that rely on self-registration. If DCR must remain active, configure the registration policy to require manual administrator approval for all client update requests (removing self-service update capability), which breaks the two-step exploit chain since the mapper type swap would be reviewed before taking effect. Additionally, audit all dynamically registered clients for suspicious protocol mapper configurations, particularly any HardcodedRoleMapper instances referencing realm-admin or similar high-privilege roles, and revoke or re-register suspicious clients. Restricting client registration privilege grants to a minimal, vetted set of service accounts reduces the attacker's prerequisite surface. Note that requiring admin approval for updates introduces operational overhead for environments with high client registration velocity.
More in Red Hat Build Of Keycloak
View allAccount takeover in Red Hat Build of Keycloak allows an unauthenticated attacker to abuse the reset-credentials flow in
Account takeover in Keycloak (Red Hat build of Keycloak, Red Hat Single Sign-On 7) arises because the IdP-initiated SAML
Authentication bypass in Red Hat Build of Keycloak (and Red Hat Single Sign-On 7) lets an unauthenticated attacker forge
Mismatched handling of the HTTP/1 absolute-form request authority in Red Hat build of Quarkus and other affected Red Hat
Authorization bypass in the Keycloak Policy Enforcer allows any authenticated user to circumvent all enforced access con
URI normalization bypass in Keycloak's Authorization Services PathMatcher allows authenticated low-privilege users to re
Privilege escalation in Keycloak's Dynamic Client Registration (DCR) component allows attackers with standard user accou
Token exchange in Keycloak bypasses Google Workspace domain allowlist restrictions, enabling any valid Google account ho
Signature-verification bypass in Keycloak (and Red Hat's Keycloak-based products such as Red Hat Single Sign-On 7 and Re
Tenant-restriction bypass in Keycloak's Microsoft identity provider integration allows attackers holding any valid Micro
Session hijacking via SAML assertion replay in Keycloak's SAML broker component allows adjacent-network attackers to aut
Open redirect in Red Hat build of Keycloak permits remote attackers to send victims to attacker-controlled hosts by abus
Same technique Information Disclosure
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today