CVE-2026-16102

Name of the Vulnerable Software and Affected Versions Keycloak (affected versions not specified)

Description A flaw exists in the Dynamic Client Registration (DCR) component of Keycloak. The default DCR policy does not properly validate the claim path for User Property mappers, which enables the writing of values to sensitive internal claim locations. An attacker possessing a standard user account and a limited Initial Access Token can exploit this to forge administrative roles within their access token. This could lead to the takeover of other clients, theft of confidential secrets, and potential full administrative control over the realm.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.