Dynamic Client Registration Vulnerability in Keycloak Identity Management Solution
CVE-2026-96547

6.5MEDIUM

Key Information:

Vendor

Red Hat
Status
Red Hat Build Of Keycloak
Red Hat Single Sign-on 7
Vendor
CVE Published:
6 November 2026

What is CVE-2026-96547?

A vulnerability exists in Keycloak's Dynamic Client Registration component, where insufficient restrictions on claim names during client setup may allow an attacker with valid registration credentials to manipulate client configuration. This can lead to improper mapping of standard user profile information to sensitive security roles, which might grant unauthorized access to external applications that rely on Keycloak for token validation.

References

https://access.redhat.com/security/cve/CVE-2026-96547
vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2539387
issue-trackingx_refsource_REDHAT

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.