keycloak-services: keycloak-services: OIDC DCR read-modify-write silently disables offline token revocation

A flaw was found in the OIDC Dynamic Client Registration DCR component of Keycloak. A bug in the response serialization causes the backchannel logout offline token revocation setting to be omitted from responses. When a client performs a standard update, this missing information causes the settin...

keycloak-services: keycloak-services: DCR azp and sid claim substitution allows Account REST session takeover

A flaw was found in the Keycloak Account REST API where it incorrectly handles session identification. A malicious client owner can manipulate their own security tokens to point to a different user's active session. This allows the attacker to access and modify the victim's account information,...

keycloak-services: keycloak-services: Injection of roles into realm default-roles via DCR endpoint

A flaw was found in Keycloak. The Dynamic Client Registration DCR endpoint does not properly validate authorization when processing the deprecated defaultRoles field. An authenticated attacker with client creation privileges or an Initial Access Token IAT can inject excessive roles into the realm...

keycloak-services: keycloak-services: DCR azp and sid claim substitution allows Account REST session takeover

A flaw was found in the Keycloak Account REST API where it incorrectly handles session identification. A malicious client owner can manipulate their own security tokens to point to a different user's active session. This allows the attacker to access and modify the victim's account information,...

CVE-2026-109081

A flaw in Keycloak 's Dynamic Client Registration (DCR) endpoint allows an authenticated attacker with client creation privileges or an Initial Access Token (IAT) to inject excessive roles into the realm's defaultRoles configuration due to improper authorization validation. This manipulation forc...

CVE-2026-109081 Keycloak-services: keycloak-services: injection of roles into realm default-roles via dcr endpoint

A flaw was found in Keycloak. The Dynamic Client Registration DCR endpoint does not properly validate authorization when processing the deprecated defaultRoles field. An authenticated attacker with client creation privileges or an Initial Access Token IAT can inject excessive roles into the realm...

CVE-2026-109081

A flaw was found in Keycloak. The Dynamic Client Registration DCR endpoint does not properly validate authorization when processing the deprecated defaultRoles field. An authenticated attacker with client creation privileges or an Initial Access Token IAT can inject excessive roles into the realm...

CVE-2026-92857 Keycloak-services: keycloak-services: dcr protocol mapper config not validated, allowing iat holders to forge sub and aud claims in signed tokens

Keycloak provides a Dynamic Client Registration feature that allows users with specific tokens to register their own applications. A flaw in how Keycloak validates these registration requests allows an attacker to create a malicious application that forges identity information. By mapping their o...

CVE-2026-92857

The Keycloak-services Dynamic Client Registration (DCR) feature contains a vulnerability where protocol mapper configurations are not validated . This flaw allows individuals holding specific tokens to register malicious applications and map their own profile details to protected fields, such as ...

CVE-2026-12985 Mattermost DCR redirect URI allowlist bypass via improper URL component validation

Mattermost versions 11.9.x = 11.9.0, 11.8.x = 11.8.4, 11.7.x = 11.7.7 Mattermost failed to validate Dynamic Client Registration redirect URIs by URL component matching glob patterns against the raw URI string instead which allows a remote unauthenticated attacker to register an OAuth client with ...

EUVD-2026-77520

Mattermost versions 11.9.x = 11.9.0, 11.8.x = 11.8.4, 11.7.x = 11.7.7 Mattermost failed to validate Dynamic Client Registration redirect URIs by URL component matching glob patterns against the raw URI string instead which allows a remote unauthenticated attacker to register an OAuth client with ...

CVE-2026-70665 Doorkeeper OpenID Connect: DCR endpoint persists unvalidated client-supplied scopes

Doorkeeper OpenID Connect implements an OpenID Connect authentication provider for Rails applications on top of Doorkeeper. Prior to 1.10.4, the Dynamic Client Registration DCR endpoint persists client-supplied scopes without validating them against the server's configured scope set. Under certai...

CVE-2026-19040

MissionSquad mcp-api (versions

CVE-2026-19040 MissionSquad mcp-api dcrClients.ts server-side request forgery

A flaw has been found in MissionSquad mcp-api up to 1.11.9. The affected element is an unknown function of the file src/services/dcrClients.ts. Executing a manipulation can lead to server-side request forgery. The attack may be performed from remote. Upgrading to version 1.11.10 is sufficient to...

CVE-2026-19040 MissionSquad mcp-api dcrClients.ts server-side request forgery

A flaw has been found in MissionSquad mcp-api up to 1.11.9. The affected element is an unknown function of the file src/services/dcrClients.ts. Executing a manipulation can lead to server-side request forgery. The attack may be performed from remote. Upgrading to version 1.11.10 is sufficient to...

Authorization Bypass Through User-Controlled Key

Overview org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services. Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key validation in the user property mapper handling for...

Authorization Bypass Through User-Controlled Key

Overview org.keycloak:keycloak-core is an open source identity and access management solution. Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key validation in the user property mapper handling for ClientRegistrationAuth and related DCR token...

CVE-2026-32111 ha-mcp OAuth 2.1 DCR mode enables network reconnaissance via an error oracle

ha-mcp is a Home Assistant MCP Server. Prior to 7.0.0, the ha-mcp OAuth consent form beta feature accepts a user-supplied haurl and makes a server-side HTTP request to haurl/api/config with no URL validation. An unauthenticated attacker can submit arbitrary URLs to perform internal network...

CVE-2026-32111 ha-mcp OAuth 2.1 DCR mode enables network reconnaissance via an error oracle

ha-mcp is a Home Assistant MCP Server. Prior to 7.0.0, the ha-mcp OAuth consent form beta feature accepts a user-supplied haurl and makes a server-side HTTP request to haurl/api/config with no URL validation. An unauthenticated attacker can submit arbitrary URLs to perform internal network...

dcr-stephen.cn Cross Site Scripting vulnerability OBB-2497355

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...