CVE-2026-109081 · Package
NO FIX YET
Keycloak's Dynamic Client Registration endpoint does not check authorization when it processes the deprecated defaultRoles field. An authenticated user with client creation rights or an Initial Access Token can add excessive roles to a realm's default roles, making every client's access tokens bloated and possibly causing a denial of service.
first public Nov 6, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Organisations that run Keycloak as their identity provider and allow Dynamic Client Registration, or issue Initial Access Tokens, are exposed. Realms that do not expose the DCR endpoint, or where only trusted administrators can create clients, are less exposed. The sources do not name affected version ranges.
Not affected if dcr-disabled, no-initial-access-tokens
Who cares identity, keycloak, self-hosted
No fix yet, per the sources.
A flaw was found in Keycloak. The Dynamic Client Registration (DCR) endpoint does not properly validate authorization when processing the deprecated defaultRoles field. An authenticated attacker with client creation privileges or an Initial Access Token (IAT) can inject excessive roles into the realm's default roles configuration. This causes clients across the realm to generate bloated access tokens, resulting in performance and memory degradation that can lead to a Denial of Service (DoS).
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.