CVE-2026-105306
MediumCVSS 6.5Summary
A flaw was found in the Dynamic Client Registration flow of the Keycloak identity and access management server. The registration process fails to filter security-sensitive client attributes when a new client is created. An attacker with a valid Initial Access Token can register a client that bypasses audience checks during token introspection, allowing them to view sensitive identity information, roles, and session details from access tokens belonging to other applications in the same realm.
Risk Assessment
An attacker with a valid Initial Access Token can access sensitive identity, role, and session information from other applications in the same realm, potentially leading to privilege escalation and confidentiality breaches.
Recommendation
Update Keycloak to a version containing the fix, restrict the issuance of Initial Access Tokens, and verify client registration policies and audience checks during token introspection.
Other vulnerabilities in Keycloak
See all- CVE-2026-101333Low
A flaw in the Micrometer user-event metrics listener of Keycloak occurs when the listener is configured to include the idp tag. An unauthenticated attacker can send requests to the identity broker login endpoint using arbitrary provider aliases, causing the system to create an unlimited number of metric time series, leading to excessive memory consumption and degraded performance of the server and monitoring tools.
- CVE-2026-19607Medium
A flaw was found in the first-broker-login flow of the keycloak-services component. It allows an attacker to register a matching username on an external identity provider, causing a collision in Keycloak and locking out the legitimate user.
- CVE-2026-17526High
Keycloak is an open-source identity and access management solution. A vulnerability was discovered where a user with the impersonation role can impersonate a realm administrator, gaining full administrative control over the realm, including the ability to manage users, clients, and roles.
- CVE-2026-79651High
A flaw was found in the theme localization endpoints of the keycloak-services component, which is the core service responsible for authentication flows and theme management in Keycloak. The issue occurs because the system accepts arbitrary locale tags from unauthenticated requests and stores them in a permanent in-memory cache without limits. An attacker can exploit this by sending a large number of unique locale tags, eventually causing the server to run out of memory and crash.
- CVE-2026-18212High
A flaw was found in the SAML Redirect Binding implementation of Keycloak where the custom DEFLATE compression and decompression helpers fail to release native zlib memory after use. An unauthenticated attacker can exploit this by sending repeated malformed SAML requests, leading to native memory exhaustion and a denial of service.
- CVE-2026-19608Medium
A flaw was found in the group policy provider of Keycloak authorization services, which is used to manage fine-grained access control to resources. The issue occurs when the system evaluates group-based policies using tokens that only contain group names rather than full paths. If two groups in different parts of the organization share the same name, a user in the unauthorized group can be mistaken for a member of the authorized group. This can allow a user to gain unauthorized access to protected resources they should not be able to reach.
- CVE-2026-0707Medium
A flaw was found in Keycloak regarding the authorization header parser. This parser is overly permissive regarding the formatting of the 'Bearer' authentication scheme, accepting non-standard characters as separators and tolerating case variations that deviate from RFC 6750 specifications.
- CVE-2017-12159High
It was found that the cookie used for CSRF prevention in Keycloak was not unique to each session. An attacker could use this flaw to gain access to an authenticated user session, leading to possible information disclosure or further attacks.
- CVE-2026-105302Medium
A flaw was found in the User Session Note mapper of the Keycloak identity and access management solution. The mapper does not validate whether a requested session note contains sensitive internal credentials, such as federated access tokens from external identity providers. This allows a delegated client administrator to leak a user's upstream bearer tokens into the tokens issued to their managed application.
- CVE-2026-105301Medium
A flaw was found in the X.509 client-certificate authenticator of Keycloak. The issue occurs when the server is configured to check certificate revocation using CRL Distribution Points or OCSP. An attacker can provide a specially crafted certificate that points to a malicious server, causing Keycloak to make unauthorized outbound requests to internal or external endpoints before the certificate is fully validated.
Original NVD description (English source)
A flaw was found in the Dynamic Client Registration flow of the Keycloak identity and access management server. The issue occurs because the registration process fails to filter security-sensitive client attributes when a new client is created. An attacker with a valid Initial Access Token can register a client that bypasses audience checks during token introspection. This allows the attacker to view sensitive identity information, roles, and session details from access tokens belonging to other applications in the same realm.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS