CVE-2026-16102

highpriority · track · 0EPSS 0.005 · 40 %ileDEEUUS

grimoire priorityP2 · Scheduled

Exploitable?

—

no known exploitation

Likely / severe?

0.46% (40th) EPSS

CVSS 8.1 · high

Is it mine?

19 products

Check your exposure

Who says so?

5 sources

cnnvd · enisa_euvd · cert_bund · nvd

EPSS · scored 2026-10-27

A flaw was found in the Dynamic Client Registration (DCR) component of Keycloak, an identity and access management solution. The default DCR policy fails to properly validate the claim path for User Property mappers, allowing them to write values to sensitive internal claim locations. An attacker with a standard user account and a limited Initial Access Token can exploit this to forge administrative roles in their access token. This allows the attacker to take over other clients, steal confidential secrets, and potentially gain full administrative control over the realm.

cvss

Technical severity, 0–10. One row per scoring source.

8.1

010

base score 0–10 · higher = more severe · hover a vector to decode

v3.18.1highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Nsecondary · ENISA EU

v3.18.1highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Nsecondary · secalert@redhat.com USexploitability 2.8 · impact 5.2

v3.17.4highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N/E:Usecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: none · Automatable: no · Technical Impact: totalcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-551USprimaryCWE-284US

affected products (19)

Products and version ranges known to be affected.

Open Source Keycloak Red Hat build of Keycloa <26.4-22all versionscert_bundDE
Open Source Keycloak Red Hat build of Keycloa <26.4.14-1all versionscert_bundDE
Open Source Keycloak Red Hat build of Keycloa <26.6-11all versionscert_bundDE
Open Source Keycloak Red Hat build of Keycloa <26.6.5-1all versionscert_bundDE
Open Source Keycloak≤ Red Hat build of Keycloa <26.6.5-1cert_bundDE
Open Source Keycloak≤ Red Hat build of Keycloa <26.4-22cert_bundDE
Open Source Keycloak≤ Red Hat build of Keycloa <26.4.14-1cert_bundDE
Open Source Keycloak≤ Red Hat build of Keycloa <26.6-11cert_bundDE
Red Hat Red Hat build of Keycloak 26.4< 26.4-22enisa_euvdEU
Red Hat Red Hat build of Keycloak 26.4< 26.4.14-1enisa_euvdEU
Red Hat Red Hat build of Keycloak 26.6< 26.6-11enisa_euvdEU
Red Hat Red Hat build of Keycloak 26.6< 26.6.5-1enisa_euvdEU
redhat build of keycloak26.4 → 26.4.14nvdUScpe:2.3:a:redhat:build_of_keycloak:*:*:*:*:*:*:*:*
redhat build of keycloak26.6 → 26.6.5nvdUScpe:2.3:a:redhat:build_of_keycloak:*:*:*:*:*:*:*:*
redhat data grid= 8.0nvdUScpe:2.3:a:redhat:data_grid:*:*:*:*:*:*:*:*
redhat jboss enterprise application platform expansion packall versionsnvdUScpe:2.3:a:redhat:jboss_enterprise_application_platform_expansion_pack:*:*:*:*:*:*:*:*
redhat single sign-on= 7.0nvdUScpe:2.3:a:redhat:single_sign-on:*:*:*:*:*:*:*:*
Bitnami keycloak26.4.0 → 26.4.14osvUSpkg:bitnami/keycloak
Bitnami keycloak26.6.0 → 26.6.5osvUSpkg:bitnami/keycloak

advisories (2)

Vendor and ecosystem advisories describing this.

WID-SEC-W-2026-2677RedHat Build of Keycloak: Mehrere SchwachstellenDeutsch2026-08-05csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in Keycloak ausnutzen, um Administratorrechte zu erlangen, Benutzerkonten zu übernehmen, Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen offenzulegen, Daten zu manipulieren oder einen Denial-of-Service-Zustand herbeizuführen.
BIT-keycloak-2026-16102Keycloak-services: keycloak-services: default dcr policy allows role forgery via user property mappers2026-08-25vendor · osvUS
A flaw was found in the Dynamic Client Registration (DCR) component of Keycloak, an identity and access management solution. The default DCR policy fails to properly validate the claim path for User Property mappers, allowing them to write values to sensitive internal claim locations. An attacker with a standard user account and a limited Initial Access Token can exploit this to forge administrative roles in their access token. This allows the attacker to take over other clients, steal confidential secrets, and potentially gain full administrative control over the realm.

also known as (3)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd cert_bund nvd osv NVD CVE.org MITRE

published 2026-08-05modified 2026-08-31

related (33)

Related entries.

ID	severity	EPSS	exploitable	published
CVE-2021-34429US	medium5.3OT high	99.3% (100th)	Exploit	2021-07-15
For Eclipse Jetty versions 9.4.37-9.4.42, 10.0.1-10.0.5 & 11.0.1-11.0.5, URIs can be crafted using some encoded characters to access the content of the WEB-INF directory and/or byp…
CVE-2021-28164US	medium5.3OT high	82.4% (100th)	Exploit	2021-04-01
In Eclipse Jetty 9.4.37.v20210219 to 9.4.38.v20210224, the default compliance mode allows requests with URIs that contain %2e or %2e%2e segments to access protected resources withi…
CVE-2021-28165US	high7.5	53.9% (99th)	Exploit	2021-04-01
In Eclipse Jetty 7.2.2 to 9.4.38, 10.0.0.alpha0 to 10.0.1, and 11.0.0.alpha0 to 11.0.1, CPU usage can reach 100% upon receiving a large invalid TLS frame.
CVE-2023-23924US	critical9.8OT high	3.57% (89th)	Exploit	2023-02-01
Dompdf is an HTML to PDF converter. The URI validation on dompdf 2.0.1 can be bypassed on SVG parsing by passing `<image>` tags with uppercase letters. This may lead to arbitrary o…
CVE-2022-29165US	critical10.0	2.10% (82nd)	—	2022-05-20
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. A critical vulnerability has been discovered in Argo CD starting with version 1.4.0 and prior to versions…

+28 more

references (18)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan