keycloak-services: keycloak-services: DCR protocol mapper config not validated, allowing IAT holders to forge sub and aud claims in signed tokens

Keycloak provides a Dynamic Client Registration feature that allows users with specific tokens to register their own applications. A flaw in how Keycloak validates these registration requests allows an attacker to create a malicious application that forges identity information. By mapping their o...

keycloak-services: keycloak-services: Confidential client secret disclosed to view-clients role via Client Registration GET

A flaw was found in the Dynamic Client Registration service of Keycloak, an open-source identity and access management solution. The issue occurs when a user with the view-clients role accesses the client registration endpoint to retrieve client details. Due to a failure to mask sensitive...

keycloak-services: keycloak-services: DCR registration-time claim-path gap allows forging realm_access.roles

A flaw was found in the Dynamic Client Registration component of Keycloak, an open-source identity and access management solution. The issue occurs because the system does not properly restrict which claim names can be used when setting up new clients. An attacker with valid registration...

keycloak-services: keycloak-services: DCR registration-time claim-path gap allows forging realm_access.roles

A flaw was found in the Dynamic Client Registration component of Keycloak, an open-source identity and access management solution. The issue occurs because the system does not properly restrict which claim names can be used when setting up new clients. An attacker with valid registration...

keycloak-services: keycloak-services: DCR protocol mapper config not validated, allowing IAT holders to forge sub and aud claims in signed tokens

Keycloak provides a Dynamic Client Registration feature that allows users with specific tokens to register their own applications. A flaw in how Keycloak validates these registration requests allows an attacker to create a malicious application that forges identity information. By mapping their o...

CVE-2026-96547

A flaw was found in the Dynamic Client Registration component of Keycloak, an open-source identity and access management solution. The issue occurs because the system does not properly restrict which claim names can be used when setting up new clients. An attacker with valid registration...

CVE-2026-109081

A flaw was found in Keycloak. The Dynamic Client Registration DCR endpoint does not properly validate authorization when processing the deprecated defaultRoles field. An authenticated attacker with client creation privileges or an Initial Access Token IAT can inject excessive roles into the realm...

CVE-2026-96547

A flaw exists in the Dynamic Client Registration (DCR) component of Keycloak , an open-source identity and access management solution. The system fails to properly restrict which claim names can be used during the registration of new clients. This allows an attacker with valid registration creden...

EUVD-2026-117921

A flaw was found in the Dynamic Client Registration component of Keycloak, an open-source identity and access management solution. The issue occurs because the system does not properly restrict which claim names can be used when setting up new clients. An attacker with valid registration...

CVE-2026-96547 Keycloak-services: keycloak-services: dcr registration-time claim-path gap allows forging realm_access.roles

A flaw was found in the Dynamic Client Registration component of Keycloak, an open-source identity and access management solution. The issue occurs because the system does not properly restrict which claim names can be used when setting up new clients. An attacker with valid registration...

CVE-2026-96547

A flaw was found in the Dynamic Client Registration component of Keycloak, an open-source identity and access management solution. The issue occurs because the system does not properly restrict which claim names can be used when setting up new clients. An attacker with valid registration...

EUVD-2026-117893

A flaw was found in Keycloak. The Dynamic Client Registration DCR endpoint does not properly validate authorization when processing the deprecated defaultRoles field. An authenticated attacker with client creation privileges or an Initial Access Token IAT can inject excessive roles into the realm...

CVE-2026-92857

Keycloak provides a Dynamic Client Registration feature that allows users with specific tokens to register their own applications. A flaw in how Keycloak validates these registration requests allows an attacker to create a malicious application that forges identity information. By mapping their o...

EUVD-2026-117607

Keycloak provides a Dynamic Client Registration feature that allows users with specific tokens to register their own applications. A flaw in how Keycloak validates these registration requests allows an attacker to create a malicious application that forges identity information. By mapping their o...

CVE-2026-92857

The Keycloak-services Dynamic Client Registration (DCR) feature contains a vulnerability where protocol mapper configurations are not validated . This flaw allows individuals holding specific tokens to register malicious applications and map their own profile details to protected fields, such as ...

CVE-2026-92857

Keycloak provides a Dynamic Client Registration feature that allows users with specific tokens to register their own applications. A flaw in how Keycloak validates these registration requests allows an attacker to create a malicious application that forges identity information. By mapping their o...

PT-2026-137579

Name of the Vulnerable Software and Affected Versions Keycloak affected versions not specified Description A flaw in the Dynamic Client Registration feature allows an attacker with a specific token to register a malicious application. By manipulating the registration request, the attacker can map...

CVE-2026-110732

The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 3.8.6 This is due to the MCP module's OAuth 2.1 Dynamic Client Registration endpoint /wp-json/mcp/v1/oauth/register being registered with...

CVE-2026-110732 AI Engine – The Chatbot, AI Framework & MCP for WordPress <= 3.8.6 - Missing Authorization to Administrator Account Takeover via Unauthenticated MCP OAuth Client Registration

The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 3.8.6 This is due to the MCP module's OAuth 2.1 Dynamic Client Registration endpoint /wp-json/mcp/v1/oauth/register being registered with...

CVE-2026-110732

The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin is vulnerable to Missing Authorization in versions up to and including 3.8.6 . The issue stems from the MCP module's OAuth 2.1 Dynamic Client Registration endpoint (/wp-json/mcp/v1/oauth/register) using a permission_callback of ...