A policy bypass vulnerability exists in Keycloak's Dynamic Client Registration (DCR) "Allowed Protocol Mapper Types" policy. The root cause is located in the testMappers() method of ProtocolMappersClientRegistrationPolicy.java. When a client is updated, the policy checks if the protocol mapper type is in the allow-list. If it is not, the code attempts to verify if the mapper already exists. However, it only validates that the config map of the incoming mapper matches the config of the existing persisted mapper; it fails to verify that the protocolMapper type itself has not changed. An attacker can exploit this by: Registering a client with an allowed mapper type (e.g., oidc-usermodel-attribute-mapper) but providing a configuration intended for a restricted mapper (e.g., {"role": "realm-management.realm-admin"}).

Performing a DCR PUT update that keeps the configuration identical but changes the protocolMapper type to a disallowed one, such as oidc-hardcoded-role-mapper.

Because the configuration is identical, the policy bypasses the type check. Once persisted, the oidc-hardcoded-role-mapper uses the "role" configuration to inject the realm-admin role into the client's tokens, escalating the attacker to a full realm administrator.