A flaw was found in Keycloak where the default Dynamic Client Registration (DCR) policy permits the use of User Property mappers without validating the target claim path. While the policy checks the mapper provider type, it does not restrict where the mapper can write data within the resulting token. An attacker with a standard user account and a limited Initial Access Token (IAT) can register a new client and configure User Property mappers (such as firstName or lastName) to target the resourceaccess.realm-management.roles claim path. By setting their user profile properties to administrative role names (e.g., manage-clients, realm-admin), the attacker can produce a forged access token containing these roles. Although recent mitigations (CVE-2026-4629) protect the Admin REST API from such forged tokens, the Client Registration API remains vulnerable because it reads the resourceaccess claim directly during authorization. An attacker can use this bypass to perform unauthorized DCR operations, including reading confidential client secrets, modifying redirect URIs, and impersonating service accounts to achieve full realm compromise.

A flaw was found in the SAML metadata import functionality of the keycloak-services component, which is the core engine for identity brokering in Red Hat Build of Keycloak. When importing identity provider metadata that lacks specific usage attributes for keys, the system incorrectly disables signature validation for SAML responses even if a signing certificate is provided. This issue allows an unauthenticated attacker to forge a SAML response and gain unauthorized access to a user account by knowing their external identifier.

A flaw was found in the organization management component of Keycloak. A delegated administrator with permission to manage organizations can create an invitation for a non-existent email address and then retrieve the secret registration link directly through the application programming interface. By using this link, the administrator can create new user accounts and add them to the organization without having the required user management permissions or access to the invited email account. This allows an administrator to bypass security boundaries and add unauthorized members to an organization.

A flaw was found in the full-scope-disabled client-policy executor within the keycloak-services component. This component is responsible for enforcing security policies during client registration and configuration in Red Hat Build of Keycloak. The issue occurs because the executor only validates the fullScopeAllowed field when it is explicitly provided in a request. By omitting this field, a delegated user can bypass the policy, resulting in a client created with full scope access. This allows the client to obtain tokens with unauthorized role mappings.

A flaw was found in the Microsoft social identity provider in Keycloak. When a Microsoft identity provider is configured with a specific tenant ID, the restriction is correctly enforced for standard browser-based logins. However, the external access-token exchange endpoint fails to perform this validation. The root cause is that Keycloak calls the tenant-agnostic Microsoft Graph /me endpoint during the exchange process. It accepts the returned user profile and issues Keycloak tokens without verifying that the tenant associated with the original Microsoft token matches the configured tenant ID in the identity provider settings. An attacker with a valid Microsoft Graph access token from an arbitrary tenant can submit it to the Keycloak token exchange endpoint. Successful exploitation allows the attacker to bypass tenant restrictions, assume an identity within the Keycloak realm, and perform actions with the privileges of that identity, such as accessing protected resources or modifying user data.

A flaw was found in the TokenManager component of the Keycloak identity management service. When an administrator attempts to revoke tokens for a specific application (client) using a "not-before" policy, the revocation may be silently ignored if the overall security realm already has an older, non-zero revocation policy in place. This issue can allow previously issued tokens to remain valid for refreshing sessions and accessing user information even after an administrator has attempted to invalidate them. ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

A flaw was found in the token endpoint of keycloak-services. The authorization code payload does not persist the issuing client identifier, and the endpoint relies on a mutable component of the code string to select the client session. An attacker who registers a client in the same realm, establishes an SSO session with a victim user, and intercepts an authorization code issued to a different client can rewrite the client identifier in the code. By redeeming this modified code at the token endpoint, the attacker can obtain tokens for their own client associated with the victim's identity. Successful exploitation allows an attacker to impersonate a user to an attacker-controlled client and access the victim's data exposed to that client.

An information disclosure vulnerability exists in keycloak-services when Fine-Grained Admin Permissions (FGAP) v2 is enabled. The issue resides in the GET /admin/realms/{realm}/groups endpoint when the search parameter is used with briefRepresentation=false. The root cause is improper authorization filtering during the construction of the group hierarchy in the search results. While a delegated admin may be explicitly denied direct access to a parent group (resulting in a 403 Forbidden on direct GET requests), the search mechanism fails to redact the parent group's details when it is returned as part of the hierarchy for a visible child group. Exploitation Conditions: FGAP v2 must be enabled.

The attacker must have an account with query-groups permissions.

The attacker must have Groups:view permissions on at least one child group within a restricted parent group.

Concrete Impact: An attacker can disclose the following information for unauthorized parent groups: Internal UUIDs and group names.

Custom group attributes (which may contain sensitive metadata).

Role mappings associated with the parent group.