CVE-2026-92857

Name of the Vulnerable Software and Affected Versions Keycloak (affected versions not specified)

Description A flaw in the Dynamic Client Registration feature allows an attacker with a specific token to register a malicious application. By manipulating the registration request, the attacker can map their own profile details to protected fields such as the user ID sub or the intended audience aud. This enables the generation of signed security tokens that forge identity information, allowing the attacker to impersonate other users or gain unauthorized access to services relying on these tokens for identity verification.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.