Remote Code Execution Vulnerability in Keycloak Client Registration Service
CVE-2026-9705
6.5MEDIUM
Key Information:
- Vendor
Red Hat
- Status
- Vendor
- CVE Published:
- 25 June 2026
What is CVE-2026-9705?
A vulnerability exists in Keycloak's client registration service that can be exploited by an attacker who holds a valid Registration Access Token (RAT). This flaw enables the attacker to reinstate a previously disabled client, which would allow them to override existing security measures. Once the client is re-enabled, the attacker can reset the client’s secret, thereby regaining potentially privileged API access. The implications of this vulnerability include unauthorized information disclosure and potential integrity breaches within the application.
Affected Version(s)
Red Hat build of Keycloak 26.4 26.4.13-1
Red Hat build of Keycloak 26.4 26.4-19
Red Hat build of Keycloak 26.4 26.4-19
References
CVSS V3.1
Score:
6.5
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged
Timeline
Vulnerability published
Vulnerability Reserved
Credit
Red Hat would like to thank Qiulin Deng for reporting this issue.