Keycloak-services: keycloak-services: injection of roles into realm default-roles via dcr endpoint

Özet

Türkçe özeti yalnızca kritik ve yüksek önemdeki açıklar için hazırlıyoruz. Bu açık için kaynağın kendi açıklamasını gösteriyoruz.

A flaw was found in Keycloak. The Dynamic Client Registration (DCR) endpoint does not properly validate authorization when processing the deprecated defaultRoles field. An authenticated attacker with client creation privileges or an Initial Access Token (IAT) can inject excessive roles into the realm's default roles configuration. This causes clients across the realm to generate bloated access tokens, resulting in performance and memory degradation that can lead to a Denial of Service (DoS).

Etkilenen sürümler2 yazılım

Kaynaklar3 kaynak

• CVE.org kaydı
• NVD kaydı
• access.redhat.com/security/cve/CVE-2026-109081 Diğer

Kayıt geçmişi

1. 6 Kas 2026 08:57Yayımlandı

İlgili açıklar

• 6,5 CVE-2026-9797Keycloak: keycloak: privilege escalation via client authentication manipulation by an authenticated administrator
• 6,5 CVE-2026-97848Keycloak-services: keycloak-services: protocol mapper with jsontype=json bypasses token sanitization
• 6,4 CVE-2026-97367Keycloak-services: keycloak-services: dcr azp and sid claim substitution allows account rest session takeover
• 6,5 CVE-2026-96547Keycloak-services: keycloak-services: dcr registration-time claim-path gap allows forging realm_access.roles
• 5,4 CVE-2026-96460Keycloak-services: keycloak-services: indefinite access token renewal via standard token exchange v2
• 6,8 CVE-2026-19688Keycloak-services: keycloak-services: admin api missing audience check