Keycloak Dynamic Client Registration lets attackers forge identity claims

Summary

Keycloak's Dynamic Client Registration does not validate a protected setting, so a user holding a registration token can forge the user ID (sub) and audience (aud) in signed tokens. The forged tokens can make attackers appear as other users to services that trust them.

Affected when

• Dynamic Client Registration enabled
• holder of an initial access token (IAT)

What to do

Update Red Hat build of Keycloak 26.4 to 26.4.17 and 26.6 to 26.6.8. Back up your installation, configuration files and databases first. For Red Hat Single Sign-On 7, check the vendor advisory.

Update to at least the version for your product:

• Red Hat build of Keycloak 26.4 26.4.17 or later
• Red Hat build of Keycloak 26.6 26.6.8 or later

Products and platforms

• Linux
• Red Hat build of Keycloak
• Red Hat Single Sign-On

CVE IDs

• CVE-2026-92857 (opens in a new tab)

Sources

• Advisory: access.redhat.com (opens in a new tab) · access.redhat.com (opens in a new tab) · access.redhat.com (opens in a new tab) · access.redhat.com (opens in a new tab)
• CVE record: cve.org (opens in a new tab)

Times

First published 2026-11-05 17:15 UTC

First seen 2026-11-09 17:00 UTC