6 matches found
keycloak-services: keycloak-services: Injection of roles into realm default-roles via DCR endpoint
A flaw was found in Keycloak. The Dynamic Client Registration DCR endpoint does not properly validate authorization when processing the deprecated defaultRoles field. An authenticated attacker with client creation privileges or an Initial Access Token IAT can inject excessive roles into the realm...
CVE-2026-109081
A flaw was found in Keycloak. The Dynamic Client Registration DCR endpoint does not properly validate authorization when processing the deprecated defaultRoles field. An authenticated attacker with client creation privileges or an Initial Access Token IAT can inject excessive roles into the realm...
EUVD-2026-117893
A flaw was found in Keycloak. The Dynamic Client Registration DCR endpoint does not properly validate authorization when processing the deprecated defaultRoles field. An authenticated attacker with client creation privileges or an Initial Access Token IAT can inject excessive roles into the realm...
CVE-2026-109081
A flaw in Keycloak 's Dynamic Client Registration (DCR) endpoint allows an authenticated attacker with client creation privileges or an Initial Access Token (IAT) to inject excessive roles into the realm's defaultRoles configuration due to improper authorization validation. This manipulation forc...
CVE-2026-109081 Keycloak-services: keycloak-services: injection of roles into realm default-roles via dcr endpoint
A flaw was found in Keycloak. The Dynamic Client Registration DCR endpoint does not properly validate authorization when processing the deprecated defaultRoles field. An authenticated attacker with client creation privileges or an Initial Access Token IAT can inject excessive roles into the realm...
CVE-2026-109081
A flaw was found in Keycloak. The Dynamic Client Registration DCR endpoint does not properly validate authorization when processing the deprecated defaultRoles field. An authenticated attacker with client creation privileges or an Initial Access Token IAT can inject excessive roles into the realm...