Security Flaw in Keycloak Product's Client Registration Management

CVE-2026-15572

What is CVE-2026-15572?

A security flaw exists in Keycloak's Dynamic Client Registration (DCR) management. The 'Allowed Protocol Mapper Types' policy is designed to restrict the types of data mappers a client can utilize. However, it fails to re-validate the mapper type during a client update, provided the mapper configuration stays unchanged. This oversight can be exploited by an attacker with client registration privileges, allowing them to initially register a mapper type with malicious settings. The attacker can then switch it for a restricted mapper type that grants high privileges, potentially resulting in unauthorized administrative access to the Keycloak realm.

References