CVE-2026-16102

Summary

The flaw in Keycloak's Dynamic Client Registration (DCR) component allows attackers to write values to sensitive claim locations, potentially forging administrative roles and gaining full administrative control over the realm.

Exploitability

Exploitation requires a standard user account and a limited Initial Access Token, making it moderately difficult. The attacker must have access to the DCR feature.

Blast radius

If exploited, this flaw could lead to the theft of confidential secrets, takeover of other clients, and full administrative control over the realm, impacting a wide range of systems and data.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Disable the Dynamic Client Registration feature or restrict access to it strictly. If a fixed version is available, upgrade to the specific version mentioned in the description, e.g., 'Upgrade to 2.590 or later'.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.