medium · CVSS v3 6.5

CVE-2026-96547

Keycloak's Dynamic Client Registration component allows an attacker with registration credentials to create a client that maps user claims t

Overview

Keycloak's Dynamic Client Registration component allows an attacker with registration credentials to create a client that maps user claims to privileged roles, enabling privilege escalation on applications that trust Keycloak tokens. This flaw can lead to unauthorized access to protected resources.

Description

A flaw was found in the Dynamic Client Registration component of Keycloak, an open-source identity and access management solution. The issue occurs because the system does not properly restrict which claim names can be used when setting up new clients. An attacker with valid registration credentials could create a client that incorrectly maps standard user profile information to sensitive security roles, potentially allowing them to gain unauthorized privileges on external applications that trust Keycloak tokens.

Impact

Confidentiality: attackers can map user claims to privileged roles, potentially exposing sensitive data. Integrity: unauthorized role assignments can alter system behavior. Availability: not directly affected. Defenders: administrators of Keycloak deployments and applications relying on Keycloak tokens.

Remediation

Apply the latest Keycloak update that restricts claim names during client registration. If a patch is not yet available, enforce a whitelist of allowed claim names via custom policy or configuration. Monitor client registration logs for unusual role assignments and audit client configurations regularly.

Risk context

Medium severity (CVSS 6.5). No EPSS data available. Defenders should treat this as a moderate risk and apply mitigations promptly.

Affected products

  • Keycloak

Scores

Severity
medium
CVSS v2
6.8
CVSS v3
6.5
CVSS v4
—
EPSS
—

Keycloak IdentityAccessManagement PrivilegeEscalation ClientRegistration TokenSecurity ModerateRisk

← All CVEs

Related CVEs

medium

CVE-2026-114427

The GutenKit WordPress plugin before 2.5.5 does not properly sanitize custom CSS saved against a post before printing it inside an inline style block on the published page, allowing users with the Author role and above to break out of the style element and store JavaScript that executes in the browser of any visitor who views the post. Exploitation affects sites running WordPress below 7.0.

View analysis

medium

CVE-2026-120659

The Redirection for Contact Form 7 plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.2.14 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to write arbitrary post meta values to newly created lead posts and copy arbitrary server-side files with allowed MIME-type extensions into the plugin's uploads directory. Exploitation requires a published Contact Form 7 form configured with the Save Entry (Save Lead) action enabled on the target site.

View analysis

medium

CVE-2026-123287

In JetBrains Datalore before 2026.4 private notebook files could be downloaded without authentication via published interactive reports

View analysis

medium

CVE-2026-84164

The HTML report that plist-to-html, CodeChecker parse --export html and CodeChecker cmd diff --output html generate puts the report message, the checker name and the source file path into a script block through json.dumps. json.dumps does not escape the less-than character, so a closing script tag in any of those three fields ends the script element and what follows is parsed as HTML. The input author is whoever controls the analysed tree or a third-party result file that report-converter ingests, or who holds PRODUCT_STORE in the cmd diff flow. The viewer is somebody else: docs/jenkins_gerrit_integration.md documents writing the report into Jenkins userContent and posting its URL into a Gerrit review. One caveat worth stating up front is that Jenkins serves userContent under a restrictive CSP that would block an inline handler, so that destination is probably safe as configured. The generated report sets no CSP of its own, so the impact lands wherever it is published without one.

View analysis