CVE-2026-92857 in Keycloak
Summary
by MITRE • 11/05/2026
Keycloak provides a Dynamic Client Registration feature that allows users with specific tokens to register their own applications. A flaw in how Keycloak validates these registration requests allows an attacker to create a malicious application that forges identity information. By mapping their own user profile details to protected fields like the user ID (sub) or intended audience (aud), an attacker can generate signed security tokens that make them appear to be a different user. This could allow an attacker to impersonate other users or gain unauthorized access to services that rely on these tokens for identity verification.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 11/05/2026
The vulnerability in Keycloak’s Dynamic Client Registration feature represents a critical failure in input validation and token generation logic, specifically within the mechanism used by authorized clients to self-register applications. This functionality is designed to streamline integration by allowing users with specific registration access tokens to programmatically define their client configurations without manual administrative intervention. However, the flaw lies in how Keycloak processes these registration requests when generating subsequent security tokens for the newly registered clients. The system fails to adequately sanitize or restrict certain fields during this process, creating a pathway for identity manipulation that undermines the fundamental trust model of the OAuth 2.0 and OpenID Connect protocols implemented by the platform.
At its core, the technical flaw involves an improper restriction on user-controlled input within protected claims. When a malicious actor utilizes their registration access token to create a new client application, they are able to inject arbitrary values into fields that should be strictly controlled by the server or derived from verified identity sources. Specifically, attackers can map their own profile details to sensitive standard claims such as sub (subject) and aud (audience). In a secure implementation, these fields must reflect the actual authenticated user and the intended recipients of the token respectively. By forging these values, an attacker effectively decouples the token’s content from its true origin, allowing them to assert arbitrary identities within the generated JSON Web Tokens or SAML assertions.
The operational impact of this vulnerability is severe, as it directly facilitates identity impersonation and unauthorized access across systems that rely on Keycloak for authentication and authorization. An attacker who exploits this flaw can generate signed security tokens that appear valid because they are cryptographically signed by Keycloak’s private keys, yet contain falsified metadata indicating the token belongs to a different user or is intended for a specific protected service. This enables privilege escalation where an unprivileged user assumes the identity of an administrator or another high-privilege account. Furthermore, it allows access to downstream services that trust these tokens without performing additional verification steps beyond signature validation, effectively bypassing authentication controls entirely.
From a classification perspective, this vulnerability aligns with CWE-287 Improper Authentication and CWE-613 Insufficient Session Expiration or Invalidation if the forged tokens are used to hijack sessions. It also relates closely to CWE-502 Deserialization of Untrusted Data in contexts where token parsing occurs without sufficient validation of claim origins. Within the MITRE ATT&CK framework, this behavior maps to T1498 Network Denial of Service is not applicable here but rather T1606 Forging Identity Tokens which describes techniques for creating fake identity tokens to bypass authentication mechanisms. The exploitation path typically involves initial access through valid registration credentials followed by lateral movement via forged identities across trusted service boundaries.
Mitigation strategies must focus on strict input validation and separation of concerns in token generation logic. Administrators should ensure that Keycloak is updated to the latest patched version where this validation flaw has been addressed. In environments where immediate patching is not feasible, restricting Dynamic Client Registration to only those clients with explicit need can reduce the attack surface. Additionally, implementing additional verification layers at downstream service providers, such as checking token issuance times and validating audience claims against known trusted issuers rather than relying solely on signature validity, provides a defense-in-depth approach. Monitoring for anomalous registration patterns or tokens containing unexpected claim values can also aid in early detection of exploitation attempts before significant damage occurs.