CVE-2026-18570

Name of the Vulnerable Software and Affected Versions Red Hat Build of Keycloak (affected versions not specified)

Description A flaw exists in the full-scope-disabled client-policy executor within the keycloak-services component, which enforces security policies during client registration and configuration. The issue arises because the executor only validates the fullScopeAllowed field when it is explicitly included in a request. A delegated user can bypass this policy by omitting the fullScopeAllowed field, leading to the creation of a client with full scope access. Consequently, the client can obtain tokens with unauthorized role mappings.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.