Improper Authorization in Keycloak's Dynamic Client Registration Endpoint
CVE-2026-109081

6.8MEDIUM

Key Information:

Vendor

Red Hat
Status
Red Hat Build Of Keycloak
Red Hat Single Sign-on 7
Vendor
CVE Published:
6 November 2026

What is CVE-2026-109081?

A vulnerability exists in Keycloak's Dynamic Client Registration (DCR) endpoint where authorization is not adequately validated for the deprecated defaultRoles field. An attacker with sufficient privileges can manipulate the realm's configuration, injecting excessive roles that result in bloated access tokens for clients throughout the realm. This can lead to performance issues and memory degradation, potentially causing a Denial of Service (DoS) as the system struggles to handle the inflated access tokens.

References

https://access.redhat.com/security/cve/CVE-2026-109081
vdb-entryx_refsource_REDHAT

CVSS V3.1

Score:
6.8
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.