Keycloak DCR Path Validation Flaw Enables Privilege Escalation
CVE-2026-16102 Published on August 5, 2026

Keycloak-services: keycloak-services: default dcr policy allows role forgery via user property mappers
A flaw was found in the Dynamic Client Registration (DCR) component of Keycloak, an identity and access management solution. The default DCR policy fails to properly validate the claim path for User Property mappers, allowing them to write values to sensitive internal claim locations. An attacker with a standard user account and a limited Initial Access Token can exploit this to forge administrative roles in their access token. This allows the attacker to take over other clients, steal confidential secrets, and potentially gain full administrative control over the realm.

Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory NVD

Vulnerability Analysis

CVE-2026-16102 is exploitable with network access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have a high impact on confidentiality and integrity, and no impact on availability.

Attack Vector:
NETWORK
Attack Complexity:
LOW
Privileges Required:
LOW
User Interaction:
NONE
Scope:
UNCHANGED
Confidentiality Impact:
HIGH
Integrity Impact:
HIGH
Availability Impact:
NONE

Timeline

Reported to Red Hat.

Made public. 21 days later.

Weakness Type

What is an Authorization Vulnerability?

The software does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

CVE-2026-16102 has been classified to as an Authorization vulnerability or weakness.


Products Associated with CVE-2026-16102

Want to know whenever a new CVE is published for Red Hat products? stack.watch will email you.

Red Hat Build Keycloak
 
Red Hat Jboss Data Grid
 
Red Hat Jbosseapxp
 
Red Hat Single Sign On
 

Affected Versions

Red Hat build of Keycloak 26.4: Red Hat build of Keycloak 26.4: Red Hat build of Keycloak 26.4: Red Hat build of Keycloak 26.4.14: Red Hat build of Keycloak 26.4.14: Red Hat build of Keycloak 26.6: Red Hat build of Keycloak 26.6: Red Hat build of Keycloak 26.6: Red Hat build of Keycloak 26.6.5: Red Hat build of Keycloak 26.6.5: Red Hat build of Keycloak 26.6.5: Red Hat Data Grid 8: Red Hat JBoss Enterprise Application Platform Expansion Pack: Red Hat Single Sign-On 7: